Ruflo is an open-source AI agent meta-harness for Anthropic Claude Code and OpenAI Codex. A critical vulnerability (CVE-2026-59726) in versions before 3.16.3 allows unauthenticated RCE and AI memory poisoning via an exposed MCP bridge. The flaw has been patched in version 3.16.3.