Noma Security has disclosed CVE-2026-59726, a maximum-severity vulnerability in the Ruflo open-source agent meta-harness that lets unauthenticated attackers take over AI agent orchestration systems. Codenamed RufRoot, the flaw carries a CVSS 10.0 rating and affects all Ruflo versions before 3.16.3, with a patch-resistant property that requires clearing the agent memory store even after applying the software fix.
The Ruflo RufRoot Vulnerability and Its Patch-Resistant Design
Ruflo is an open-source agent meta-harness that orchestrates multiple AI coding agents, wrapping the Model Context Protocol to coordinate agent actions across development teams. The RufRoot vulnerability allows unauthenticated remote code execution on Ruflo servers that host Claude Code and OpenAI Codex agent instances. Noma Security described the flaw as patch-resistant because even after organizations apply the Ruflo fix, attacker modifications to the underlying agent memory store persist, enabling continued malicious command execution until the memory is explicitly cleared.
CVE-2026-59726 Agent Memory Persistence Survives Ruflo Software Patches
The patch-resistant quality of RufRoot stems from its position in the architecture. The vulnerability grants attackers the ability to modify the agent memory store — the persistent data layer where agents retain context, instructions, and state across sessions. Because the Ruflo patch only fixes the software entry point, any malicious modifications already written to the memory store remain active after patching. Noma Security warned that attackers could use this persistence to deploy malicious AI agent swarms that survive patching cycles, continuing to operate within the compromised environment. This represents a new category of vulnerability for AI infrastructure, where the attack targets the data layer rather than the execution layer and standard patch management procedures do not provide complete remediation.
RufRoot CVSS 10.0 Grants Control Over Claude Code and Codex Agents
A CVSS 10.0 rating — the maximum possible — reflects the combination of unauthenticated network access, no required privileges or user interaction, and the potential for complete system compromise. In the context of AI agent orchestration, the severity is amplified by what the compromised system can do. A Ruflo server manages AI agents that have access to code repositories, build pipelines, cloud infrastructure, and potentially production deployments. An attacker controlling the orchestration layer can issue instructions to every agent under management, effectively gaining the capabilities and access of the entire AI development workforce on that instance. The ability to poison agent memory is an added dimension: attackers can modify the instructions, context, and goals that the AI agents operate under, turning them into malicious actors that appear to function normally.
No Known Active Exploitation but Significant Practical Risk
Noma Security reported no evidence of active in-the-wild exploitation as of the disclosure date. However, the absence of active attacks does not reduce the urgency for organizations running Ruflo. AI infrastructure adoption has outpaced security hardening across the industry, and agent orchestration platforms represent a new attack surface that many security teams have not yet fully assessed. The disclosure of a maximum-severity, remotely exploitable vulnerability in one of these platforms creates a narrow window for defenders to patch before threat actors build and deploy exploits. The fact that Ruflo is open-source means that exploit developers have full access to the source code to study the vulnerability’s mechanism and develop working exploits without reverse engineering.
Remediation Steps Beyond the Standard Patch
The standard patching playbook — upgrade the software and restart — is insufficient for RufRoot. Organizations running Ruflo must upgrade to version 3.16.3 or later and then explicitly clear agent memory stores to remove any attacker modifications that may have been made before the patch was applied. Noma Security’s disclosure highlights a broader principle for AI infrastructure security: when the attack vector targets a persistent data layer rather than a software execution path, the patch addresses only half the problem. Security teams responding to the disclosure should treat memory store clearing as a mandatory step in their remediation process, not an optional cleanup task.
