Technical details disclosed for a max-severity Paperclip vulnerability

Threat summary

On August 5, researchers disclosed technical details for three vulnerabilities affecting Paperclip, an open-source platform described as "the operating system for your AI company."

Paperclip is a Node.js server and React-based platform that allows organizations to manage teams of artificial intelligence (AI) agents. These agents can connect to business applications, cloud services, source code repositories, databases, and automation workflows, allowing them to access and act on organizational data.

Paperclip includes functionality for importing companies from portable bundles and YAML-based configuration files that define agents and the commands they execute.

CVE-2026-41679

The findings include CVE-2026-41679, a vulnerability with a CVSS score of 10.0. It affects network-accessible Paperclip deployments running in authenticated mode with default registration settings and allows an unauthenticated threat actor to achieve full remote code execution without credentials or user interaction. Researchers demonstrated a multi-step exploitation process consisting of six application programming interface (API) calls that progresses from account registration to command execution on the underlying server.

The process begins when a newly registered user enters Paperclip's command-line interface (CLI) authorization workflow and approves their own API credential, resulting in board-level API access. Researchers found that while creating a company directly required instance administrator privileges, the company import function required only board-level access, allowing a threat actor to reach functionality intended for more privileged users.

Using this access, a threat actor could import a malicious .paperclip.yaml file defining an AI agent configured to execute operating system commands. When the agent was activated, Paperclip executed the specified command using the permissions assigned to the Paperclip service account.

GHSA-xfqj-r5qw-8g4j

Researchers also identified another issue, tracked as GHSA-xfqj-r5qw-8g4j (CVSS 8.3), which affects multiple API endpoints that did not consistently enforce authentication and authorization requirements.

The flaw exposed workflow data, heartbeat issue data, agent skill documentation, deployment details, feature flags, authentication readiness information, and version information that could help a threat actor understand the target environment and identify additional attack opportunities.

GHSA-x8hx-rhr2-9rf7

The third issue, GHSA-x8hx-rhr2-9rf7 (CVSS 9.6), affects Paperclip deployments operating in local_trusted mode. Researchers demonstrated a Domain Name System (DNS) rebinding attack that allows an attacker-controlled webpage to interact with a locally running Paperclip instance.

This access can be used to import malicious agent configurations and execute commands on a developer workstation through legitimate Paperclip functionality.

Paperclip addressed the three vulnerabilities in version 2026.416.0 on April 16, and a Metasploit module is available for CVE-2026-41679.

Analysis

Although the three vulnerabilities affected different parts of Paperclip, each provided a way to reach functionality intended for trusted users or trusted systems. Depending on deployment, a threat actor could access sensitive application data, interact with privileged workflows, or execute operating system commands on the affected host.

Researchers found that Paperclip's agent configuration capabilities were central to the impact of these vulnerabilities: the same import functionality used for legitimate agent setup is what allowed attackers, in each case, to reach privileged execution paths using only built-in platform features rather than custom exploit code.

Because Paperclip acts as a central platform for AI agents, and those agents often have access to business data and enterprise resources, compromise could provide access to application data, source code repositories, credentials, secrets, and internal services accessible from the affected system.

Mitigations

Organizations running Paperclip are advised to first identify whether the platform is deployed within their environment and determine the version in use. Organizations should prioritize internet-facing deployments, as the documented exploitation process requires network access to the application.

Those using Paperclip in local development or testing environments also benefit from the same update, as the local_trusted-mode vulnerability described above poses the same risk.

Organizations are also advised to review the permissions assigned to the Paperclip service account and inventory the resources accessible from the platform to help determine potential exposure and guide response activities.

To reduce future risk, organizations are advised to limit exposure of Paperclip management interfaces, restrict access to trusted users and networks, review registration settings, and apply least-privilege principles to Paperclip service accounts and connected integrations. Because Paperclip can interact with business applications, repositories, databases, cloud services, and automation workflows, limiting the resources available to the platform can reduce the impact of a successful compromise.

Organizations that identify signs of compromise, or that cannot determine whether an exposed instance was accessed, are advised to review imported company configurations, validate system integrity, rotate credentials and secrets accessible from the affected environment, and investigate connected systems for follow-on activity.

Stay on top of emerging threats like this.

Sign up to receive a weekly roundup of our security intelligence feed. You'll be the first to know of emerging attack vectors, threats, and vulnerabilities. 

Sign up