Ruflo, an open-source AI agent orchestration harness with more than 66,000 GitHub stars that lets developers spin up coordinated swarms of Claude Code and Codex agents, shipped a default Docker Compose configuration that bound its Model Context Protocol bridge to all network interfaces with zero authentication. That bridge exposes 233 tools over HTTP, including one that runs arbitrary shell commands, so a single unauthenticated POST request to port 3001 was enough to get a full remote shell inside any reachable deployment, no credentials, no API key, nothing. Researchers demonstrated the entire exploit as a single curl command. Once inside, an attacker could read every LLM provider API key stored in the container's environment, spawn their own attacker-controlled agent swarms billed to the victim's account, harvest every conversation stored on the platform, and, this is the part worth sitting with, write poisoned patterns directly into Ruflo's persistent AgentDB memory store, meaning the corruption does not end when the intrusion does. A tampered memory pattern keeps steering the AI's behavior for every future user of that deployment until someone notices and cleans it out. The maintainer shipped a fix within 24 hours of disclosure that binds the bridge to localhost by default, requires authentication for tool calls, and turns on MongoDB auth. The broader lesson for anyone building or deploying agent infrastructure: an MCP bridge is functionally a root shell wearing a JSON-RPC costume, and 'authentication optional' should never be the default for anything that can execute a command, touch a database, or write into a model's memory. Any team running agent orchestration tooling should specifically check whether its bridge ports are bound to 0.0.0.0 by default rather than assuming the framework handled it.