Critical vulnerabilities in the open-source Paperclip AI-agent orchestration platform could allow attackers to execute commands remotely on exposed servers or on a developer’s local machine. These flaws arise from broken authorization boundaries across agent imports and API routes, as well as trust assumptions for localhost.
Paperclip is designed to coordinate autonomous agents across “companies,” with adapters that connect these agents to execution environments.
Its built-in process adapter can legitimately launch configured commands as child processes of the Paperclip server, which makes agent configuration security-sensitive.
This means that anyone who can import, configure, and activate an agent can potentially execute code with the privileges of the underlying Paperclip service account.
Critical Paperclip AI Agent Flaws
According to the Oasis Security, the most severe issue, tracked as CVE-2026-41679 and rated with a CVSS score of 10.0, affected network-accessible Paperclip deployments running in authenticated mode with default registration settings. Versions earlier than 2026.416.0 were impacted.
An unauthenticated attacker could register an account without email verification, create a CLI authorization challenge, and approve that same challenge after signing in.
This enabled the attacker to activate a persistent board-level API credential. At the same time, direct company creation required instance-administrator rights, and a separate company-import path required only board-level access.
The import mechanism accepted `.paperclip.yaml` manifests containing agent definitions and adapter configurations. An attacker could import a new company with a process-based agent that had a chosen command and then invoke Paperclip’s wake-up endpoint. The process adapter would execute the command as the Paperclip server’s operating system user.
The potential impacts included theft of application data, source code, and local credentials; exposure of secrets to agent processes; and lateral movement into internal services accessible from the affected host.
Paperclip addressed this flaw in version 2026.416.0 by requiring instance-administrator privileges for new-company imports and enforcing access checks for existing-company imports.
A separate high-severity advisory, GHSA-xfqj-r5qw-8g4j (CVSS 8.3), identified API endpoints missing expected authentication or company-scoping controls in authenticated mode.
The affected routes exposed heartbeat-run data, agent skill documentation, and health information, including deployment mode, version, bootstrap state, and feature flags.
Although these endpoints did not independently enable remote code execution, they could reduce attackers’ reconnaissance effort and disclose cross-tenant workflow information.
The vendor responded by adding authentication, company-access validation, reducing unauthenticated health responses, and expanding regression testing.
The third flaw, GHSA-x8hx-rhr2-9rf7, is a CVSS 9.6 DNS rebinding vulnerability affecting Paperclip’s default local_trusted mode before version 0.3.1. In this mode, requests to the loopback service were treated as implicit administrator actions.
An attacker-controlled webpage could use DNS rebinding to send same-origin requests to a local Paperclip instance at 127.0.0.1. Because Paperclip accepted arbitrary Host headers, the malicious page could import and activate a process-based agent, resulting in code execution with the developer’s local privileges.
Organizations running Paperclip should upgrade to versions beyond the affected releases, restrict network exposure, review registration settings, and treat imported agent configurations as executable content.
Agent platforms should implement a deny-by-default authorization policy, validate host and origin assumptions for local services, and require approval workflows for imports that introduce powerful execution adapters.
Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world
