Noma Tells LDS Why Patching Ruflo's CVSS 10 Flaw Cannot Undo Poisoned AI Memory

Ruflo's MCP bridge is an Express.js server on port 3001 that Docker Compose bound to all network interfaces by default. Its POST /mcp endpoint implements the Model Context Protocol's JSON-RPC interface, and, as Ainhorn put it, "you send it a tool name and arguments and it executes them without any authentication whatsoever."

Among those 233 tools is ruflo__terminal_execute, which runs shell commands inside the container. "One curl, you're running code inside the container as the node user," he said. From there the chain is short: printenv returns every provider API key, and the MongoDB instance holding all user chat history had no authentication either.

Ainhorn said Ruflo drew Noma's attention because of what it can do rather than because of a hunch. The platform ships shell access, agent swarms, persistent memory, a self-learning pipeline and knowledge-graph retrieval. "When a platform can do that much, the first question that comes to mind is 'who's allowed to ask it to do those things?', in Ruflo's case the answer turned out to be anyone."

Ruflo stores patterns that shape future model behaviour in a learning pipeline called AgentDB, and one of the exposed tools wrote directly to it. For the proof of concept, Ainhorn stored a fake SOC2 compliance policy instructing the AI to post environment variables to an attacker-controlled URL in every deployment script it subsequently generated.

"The pattern looks like legitimate organizational policy," he said. "The AI has no way to distinguish it from real company guidance. It just incorporates it into future responses. That's the persistence problem. You patch the vulnerability, restart the container, but the poisoned pattern is still in the database influencing every conversation going forward."

That is the difference between this and a conventional remote-code-execution bug, and it is why Ruflo's own advisory tells operators of previously exposed instances to rotate keys and audit the pattern store rather than simply upgrade.

Asked how anyone actually performs that audit, Ainhorn was blunt: "It's mostly manual." Teams connect to the MongoDB instance and review stored patterns for anything they did not create, paying attention to entries that reference external URLs, instruct the AI to include specific content in its output, or imitate internal policies nobody wrote.

The obvious shortcut is the one he warned against. "You could use an AI agent to help audit the memory, but that's a chicken-and-egg problem, if the memory is already poisoned, the agent reviewing it could be influenced by the same tampered patterns."

For teams checking exposed deployments, he listed what to look for: unexpected files in the application directory, injected require statements in index.js, outbound connections to unknown domains, and memory-store patterns nobody on the team created. Noma found no evidence of exploitation in the wild, though he noted an attacker at this level of access "can easily clean up after themselves."

His broader concern is awareness rather than tooling. "Most organizations don't even know their agent platforms have persistent memory, let alone that it could be tampered with."

We asked whether other agent frameworks carry the same default exposure. "It's a pattern," Ainhorn said. "These platforms ship with powerful capabilities and no access control because they were built for local use. The moment the service binds to a network interface, everything it can do is exposed. And docker-compose defaults to binding to all interfaces."

He added that Noma is "actively researching other platforms in this space and seeing similar patterns." The company has not named them, so that claim currently rests on Noma's word.

Against the argument that faster discovery and patching solves this class of problem, he was direct: "Find and patch is necessary but not sufficient. With agent platforms that have persistent memory, the damage can outlive the fix." What he wants instead is visibility, into which agent platforms are running, what tools they can reach, and what is sitting in their memory.

Noma says it found "numerous" exposed instances through internet scanning but has published no count, and we have asked for one. Ruflo's reported reach, roughly 67,000 GitHub stars and, per Noma's research, 10 million downloads and a million active users, is company-reported.

Timing is worth holding in mind too. The fix has been available since July 1, so any instance still exposed has had four weeks to upgrade, and the publicity lands the week Black Hat opens in Las Vegas.

Asked what other open source projects should copy from the maintainers' response, Ainhorn answered with one word: "Everything." They took it seriously from the first message, published an advisory within a day, and scored it honestly at CVSS 10. The fix went beyond the reported endpoint, and the remediation notes told operators to rotate keys and audit memory rather than just update.

"I truly and firmly believe that's how responsible disclosure should work on both sides," he said.

For anyone building on this stack, his summary of the lesson was the shortest thing he said: "If it touches the network, it needs authentication and runtime controls and protection. That goes for any tool execution layer, not just agent frameworks."

We covered the related research on poisoning long-term agent memory earlier this month.