Critical Paperclip Flaws Let Attackers Gain Admin Access

Key Takeaways

• Multiple critical vulnerabilities have been uncovered in Paperclip, an AI agent orchestration platform.
• The most severe flaw, CVE-2026-41679, allows unauthenticated attackers to achieve remote code execution and administrative access.
• Affected systems include network-accessible Paperclip deployments with default authenticated configurations and local_trusted mode installations.
• Successful exploitation can lead to data exposure, credential theft, and full system compromise.
• Patches are available, and immediate upgrades are strongly recommended.

Security researchers have unveiled a series of critical vulnerabilities within Paperclip, a platform designed for orchestrating autonomous AI agents. These flaws could permit unauthorized individuals to gain administrative control and execute arbitrary commands on vulnerable servers.

Critical Remote Code Execution Flaw

The most significant vulnerability, identified as CVE-2026-41679, carries a maximum CVSS score of 10.0. This flaw impacts Paperclip deployments accessible over a network that utilize the default authentication settings. Paperclip’s core function involves enabling organizations to manage AI agents through various components like companies, tasks, adapters, and custom workflows. A key feature allows users to import “company bundles,” which are typically .paperclip.yaml files.

These YAML files are not merely configuration documents; they can define agents, their execution adapters, and the commands these agents are authorized to run. This functionality transforms what appears to be a benign configuration import into a potential vector for high-risk code execution.

Exploiting the Authorization Mismatch

The root cause of this critical vulnerability was an authorization bypass. While Paperclip typically mandated instance-administrator permissions for direct company creation, a less privileged user with “board-level” access could exploit the import route to introduce a new company. This disparity allowed an attacker to craft and import a company bundle containing a malicious agent configuration.

The attack sequence commences with open registration, where a remote attacker can create an account without email verification. Following registration, the attacker can sign in, generate a CLI authorization challenge, and approve it using the same account. This process inadvertently activates a persistent board API token, granting the attacker elevated API access without requiring an independent approval step. With this token, the attacker gains access to the company import route and can upload their specially crafted bundle.

The malicious .paperclip.yaml file can be configured to instruct an agent to leverage Paperclip’s built-in process adapter. This adapter is designed to launch commands as child processes directly on the host server. Once the malicious company is imported, the attacker can “wake” the agent, prompting Paperclip to execute the attacker’s chosen command. According to the Oasis report, successful exploitation grants the attacker the same permissions as the operating system account running the Paperclip service. This level of access could expose sensitive application data, source code repositories, local credentials, secrets accessible to agent processes, and internal services reachable from the compromised host.

Additional Vulnerabilities

Beyond the primary remote code execution flaw, two other significant vulnerabilities were identified, expanding the overall risk profile:

• Inconsistent API Authentication and Authorization

  Certain API endpoints were found to lack consistent enforcement of authentication or company-level authorization. These exposed sensitive data such as heartbeat issue information, agent skill documentation, and health metrics. This exposure could inadvertently reveal critical deployment details, feature flags, authentication readiness status, and the precise version of Paperclip installed, providing valuable reconnaissance for attackers.

• DNS Rebinding in local_trusted Mode

  A critical issue was also discovered in Paperclip’s local_trusted mode. In this configuration, the service binds to 127.0.0.1, operating under the assumption that all incoming requests originate from trusted local software. Researchers demonstrated that a DNS rebinding attack could subvert this assumption. An attacker-controlled website could use browser-based requests to reach the local Paperclip API, tricking the service into treating these requests as legitimate administrator actions. This would allow an attacker to import and activate a malicious agent, leading to command execution on the developer’s local machine.

Mitigation and Remediation

Paperclip has addressed these vulnerabilities by implementing stronger authorization requirements for new company imports, enhancing company-scoping checks, securing previously exposed API routes, and incorporating hostname validation for deployments running in local_trusted mode.

What You Should Do

• Upgrade Immediately: Organizations using Paperclip should apply the latest patches and upgrade their installations without delay.
• Restrict Public Registration: Where not strictly necessary, disable public registration to prevent unauthorized account creation.
• Review Agent Configurations: Scrutinize all imported agent configurations, treating agent adapters and command fields as privileged executable code.
• Network Segmentation: Implement network segmentation to limit the exposure of Paperclip instances to untrusted networks.
• Principle of Least Privilege: Ensure the operating system account running Paperclip operates with the absolute minimum necessary privileges.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.