Paperclip AI Flaws Open Door to Unauthenticated Command Execution
Three vulnerabilities in the open-source AI orchestration platform Paperclip have left servers and developers’ machines exposed to unauthenticated command execution. Two of the flaws carry critical ratings, and one holds a perfect CVSS score of 10.0. Researchers at Oasis Security published their findings on August 4, revealing how attackers could exploit these weaknesses to run arbitrary commands and access sensitive data.
The flaws affect Paperclip, a control plane designed for operating what its developers call zero-human companies. Oasis Security uncovered all three bugs during an assessment of the platform’s authenticated and local deployment modes. The disclosure follows a string of similar incidents, including a critical Flowise flaw and a Langflow bug exploited within 20 hours of disclosure.
From Self-Registration to Code Execution: CVE-2026-41679
The most severe vulnerability, CVE-2026-41679 (CVSS 10.0), affects authenticated deployments. Paperclip allowed self-registration without email verification. Its CLI authorization flow let a new user approve their own credential challenge, turning that account into a persistent board-level API key. No separate approver was needed.
That key could then reach the company import route. Paperclip restricted direct company creation to instance administrators, but the equivalent import path checked only for board-level access. An attacker could use this to introduce a bundle containing an agent configured with the process adapter—a legitimate feature that launches a specified command as a child process. Waking that agent ran the attacker’s command with the server’s operating-system privileges.
Second Flaw: Missing Access Checks (GHSA-xfqj-r5qw-8g4j)
A second finding, GHSA-xfqj-r5qw-8g4j (CVSS 8.3), covered several routes that omitted access checks entirely. These exposed heartbeat data, agent documentation, and health information. While less severe than the command execution flaw, this still leaked sensitive operational details to unauthenticated attackers.
A Developer’s Browser as an Attack Path: DNS Rebinding Flaw
The third vulnerability, GHSA-x8hx-rhr2-9rf7 (CVSS 9.6), reached the same execution sink from the opposite direction. Paperclip’s local development mode binds to loopback and treats every request as an implicit instance administrator. That assumption holds for local clients but not for browsers.
DNS rebinding let an attacker-controlled webpage cross that boundary. Once the attacker’s server became unreachable, the browser retried the hostname against loopback while still treating the connection as same-origin. Paperclip accepted the rebound requests as administrator actions. The page then imported and woke a malicious agent, executing commands on the developer’s machine.
Industry Reaction: A Systemic Failure in Identity Boundaries
Darren Guccione, CEO at Keeper Security, called the findings “a systemic failure in how AI agent control planes handle identity boundaries.” An attacker controlling an agent configuration does not merely reach data, he said, but can direct privileged action across every system that agent touches. This highlights the growing risk as AI agents gain more access to enterprise systems.
Patches Released: What You Need to Do
All three vulnerabilities were patched after disclosure. The two authenticated-mode findings were fixed in Paperclip 2026.416.0, which now requires instance administrator privileges for new-company imports. The rebinding flaw was addressed in version 0.3.1, which enables hostname validation in local mode.
If you’re running Paperclip, update immediately:
- For authenticated deployments, upgrade to version 2026.416.0 or later.
- For local development mode, upgrade to version 0.3.1 or later.
- Review your existing agents and imports for any suspicious bundles.
- Check logs for unexpected command executions or agent activations.
The rapid exploitation of similar AI platform flaws underscores the urgency. Attackers are actively scanning for vulnerable AI orchestration tools. The AI agent security landscape is evolving fast, and patching is only the first step. Organizations should also audit their identity boundaries and access controls across all AI-related infrastructure.
