Noma Security researchers disclosed a critical flaw in Ruflo, an open-source agent framework for Anthropic Claude and OpenAI Codex integrations. CVE-2026-59726 carries a perfect CVSS score of 10.0 and allows unauthenticated attackers to execute arbitrary code remotely on systems running vulnerable versions.
Ruflo versions prior to 3.16.3 contain the vulnerability, dubbed RufRoot. The flaw enables attackers to bypass authentication entirely and gain command execution privileges. This creates two distinct attack vectors. First, attackers can directly compromise servers or workstations running the framework. Second, the vulnerability permits memory poisoning of AI models using the framework. An attacker could inject malicious instructions or data into the AI's context, causing the model to behave unexpectedly or produce harmful outputs for all subsequent users.
The threat extends beyond isolated systems. Organizations deploying Ruflo as part of their AI application stack face supply chain risk. If an attacker poisons the AI memory, the malicious context persists across multiple queries and applications. This means a single exploitation could compromise multiple dependent services simultaneously.
Development teams using Ruflo for Claude or Codex integrations must patch immediately to version 3.16.3 or later. Users unable to update should isolate affected systems from production environments and restrict network access to the Ruflo service.
The vulnerability highlights growing security concerns around open-source AI frameworks. As organizations accelerate AI deployment, framework security becomes a critical foundation. Attackers targeting agent frameworks gain leverage over multiple downstream AI applications simultaneously. Unlike traditional code execution vulnerabilities, RufRoot also creates data integrity issues by corrupting the AI model's reasoning process itself.
Organizations should conduct code reviews of other open-source AI integrations in their stack. Vendors and maintainers of Ruflo