Paperclip AI Vulnerabilities Allow Unauthenticated Command Execution
Three critical vulnerabilities in the Paperclip AI agent orchestration platform enable unauthenticated attackers to execute arbitrary commands and expose sensitive data.
Oasis Security researchers have uncovered three critical vulnerabilities in Paperclip, an open-source AI agent orchestration platform, allowing unauthenticated attackers to execute arbitrary commands with server-level privileges and potentially access sensitive data. The flaws, detailed in research published on August 4th, affect both authenticated and local deployment modes of the platform, which is designed for operating "zero-human companies."
The most severe vulnerability, CVE-2026-41679 with a CVSS score of 10.0, impacted authenticated deployments. Attackers could exploit a self-registration process that bypassed email verification. By leveraging the CLI authorization flow, an attacker could approve their own credential challenge, effectively creating a persistent board-level API key. This key could then be used to import a malicious agent configured with the process adapter, a legitimate feature that executes commands as a child process. This allowed the attacker's command to run with the server's operating system privileges.
A second vulnerability, GHSA-xfqj-r5qw-8g4j (CVSS 8.3), involved several API routes that lacked proper access checks. This oversight exposed sensitive data such as heartbeat information, agent documentation, and health status to unauthorized users. While not leading to code execution, this flaw presented a significant risk of data leakage.
The third vulnerability, GHSA-x8hx-rhr2-9rf7 (CVSS 9.6), targeted the local development mode of Paperclip. In this mode, the platform binds to the loopback interface and implicitly trusts all requests as originating from an instance administrator. Attackers could exploit this trust using DNS rebinding techniques. By tricking a developer's browser into visiting a malicious webpage, an attacker could then cause the browser to retry requests against the loopback interface while maintaining the illusion of a same-origin connection. Paperclip would then process these rebound requests as administrator actions, allowing the attacker to import and activate a malicious agent, thereby executing commands directly on the developer's machine.
These findings highlight a broader trend of security weaknesses emerging in AI agent platforms, following similar disclosures for tools like Flowise and Langflow. Darren Guccione, CEO at Keeper Security, noted that these vulnerabilities represent a "systemic failure in how AI agent control planes handle identity boundaries," emphasizing that compromised agents can lead to privileged actions across interconnected systems.
Paperclip has since released patches for all identified vulnerabilities. The authenticated mode issues were addressed in Paperclip 2026.416.0, which now enforces instance administrator privileges for new company imports. The DNS rebinding flaw in local development mode was fixed in version 0.3.1 with the implementation of hostname validation.
Despite the patches, the incident underscores the critical need for robust security practices in the development and deployment of AI orchestration tools. As these platforms become more integrated into critical infrastructure and developer workflows, vulnerabilities that allow unauthenticated command execution pose a severe threat to data integrity and system security.
The new article details a second critical vulnerability (GHSA-x8hx-rhr2-9rf7, CVSS 9.6) that affects Paperclip deployments in its default local_trusted mode, requiring only a user to visit an attacker-controlled page. Additionally, it notes that while Paperclip v2026.416.0 addresses the import-authorization and hostname-validation flaws, the DNS-rebinding advisory does not specify a patched version for the second vulnerability. Rapid7 has released a Metasploit module for the more severe CVE-2026-41679, and CISA has classified its exploitation as proof-of-concept, though no exploitation in the wild has been reported.