TECH NEWS

Critical Ruflo Flaw Lets Attackers Spawn Rogue AI Swarms

Unauthenticated attackers could exploit a critical-severity vulnerability in the open source AI agent orchestration platform Ruflo to execute commands inside the container, Noma Labs security researchers warn.

A popular automation assistant with over 67,000 GitHub stars, Ruflo (formerly Claude Flow) comes with a multi-model AI chat interface, agent swarms, persistent memory, and built-in Model Context Protocol (MCP) tool calling.

Ruflo allows organizations to use AI applications, courtesy of agent swarms (support for coordinating up to 100 agents on shared enterprise-grade tasks), long-term memory enabling agents to recall past interactions, and an integrated MCP server enabling agents to execute various tasks.

“The bridge exposes 233 tools covering shell access, database operations, agent management, and memory storage, making it the single point through which every agent action flows. Because the MCP Bridge requires direct access to the underlying system resources to execute these commands, it creates a high-stakes security boundary,” Noma explains.

...

Copyright of this story solely belongs to securityweek.com. To see the full text click HERE

https://media.wired.com/photos/6a69454b8979604d57f1d48c/191:100/w_1280,c_limit/Dont-Get-Attached-to-Jimothy-Culture%20(0-00-00-00).jpg

Don’t Get Too Attached to Jimothy

On July 14, internet history was made. After capturing video of a cryptid-like raccoon with a hunched spine and stumpy tail in Seattle's Ballard neighborhood, Kiana Hall uploaded the footage to her Instagram account, referring to the sprightly little furball as “Jimothy.” (Later, asked in the comments where

https://substackcdn.com/image/fetch/$s_!zvvM!,w_1200,h_675,c_fill,f_jpg,q_auto:good,fl_progressive:steep,g_auto/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F840fa...

How compute could become over 10x costlier as AI capabilities and monetization outpace supply, and a look at the implications if Anthropic hits $1T in revenue

Sponsor Posts Subquadratic: the LLM built for 12M-token reasoning — SubQ can reason across entire codebases and document sets in one pass with no RAG workarounds. Read how SubQ 1.1 Small holds near-perfect retrieval out to 12M tokens. Most carriers track everything. Cape doesn't. — Unlimited talk, text &

https://hothardware.com/contentimages/NewsItem/71246/content/16x9_2133x1200_highres-ibuypower-gaming-pc.jpg

iBuyPower Gaming PC With Ryzen 9 And RX 9070 XT Drops To $1,799

Can you imagine buying a potent gaming PC at a fair price in this economy? Surprising as it may be, there are actually desktop deals to be had, and not just on systems with previous-generation hardware, either. Over at Walmart, you can choose between a couple of iBuyPower setups that

https://media.wired.com/photos/6a6a949c602a98f3436cc897/191:100/w_1280,c_limit/Security_OpenAI%20Could%20Have%20Stopped%20Its%20Models%E2%80%99%20Hacking%20Spree_v1.jpg

OpenAI’s Hacking Debacle Was a Human Mistake

The age of rogue AI hacker agents has arrived—but it didn't have to happen this way. After an OpenAI agent breached the Hugging Face platform earlier this month, the two companies said this week that the hacking spree was more extensive than previously thought and also involved

Read more

Don’t Get Too Attached to Jimothy

How compute could become over 10x costlier as AI capabilities and monetization outpace supply, and a look at the implications if Anthropic hits $1T in revenue

iBuyPower Gaming PC With Ryzen 9 And RX 9070 XT Drops To $1,799

OpenAI’s Hacking Debacle Was a Human Mistake