Researchers at Noma Labs have discovered a critical vulnerability known as the RufRoot flaw in the open-source harness Ruflo, which is widely used in the Model Context Protocol ecosystem to manage AI agents from various providers like Claude and Codex. This vulnerability allows attackers to gain complete control over agent behavior and tamper with memory through a single unauthenticated request, posing a significant security risk. Notably, the effects of this flaw can persist even after patches are applied, enabling ongoing manipulation of AI outputs in affected systems.

Ruflo: Ruflo is an open-source AI multi-agent orchestration platform, originally launched as Claude Flow, that enables deployment of multi-player agent swarms, coordination of autonomous workflows, and development of conversational AI systems integrated with multiple LLM providers. It incorporates the Model Context Protocol (MCP) to connect agents to external tools and maintains persistent agent memory stores. The platform is directly impacted by a newly disclosed maximum-severity vulnerability in its unauthenticated MCP bridge, which permits remote code execution and the spawning of attacker-controlled rogue AI swarms.

Platform Context: Ruflo serves as a widely used open-source harness in the Model Context Protocol ecosystem for hosting and orchestrating AI agents across providers such as Claude and Codex.
Risk Persistence: The vulnerability’s effects on agent memory can remain even after patches are applied, enabling ongoing malicious steering of AI outputs in affected deployments.
Vulnerability Discovery: Researchers at Noma Labs identified the RufRoot flaw in Ruflo, demonstrating how it could allow full control over agent behavior and memory tampering via a single unauthenticated request.