Paperclip AI flaws have been reported in the open-source control plane for AI-agent teams. Researchers found multiple weaknesses that, in specific deployment scenarios, can allow an attacker to turn agent configuration into executable behavior—ultimately leading to command execution on a network server or a developer machine.
In addition to the command-execution paths, a separate issue describes API routes that may reveal sensitive information or bypass the access checks expected for authenticated operations. Below is a clear overview of what was found, how the attacks work, and what operators should do to reduce risk.
How the vulnerabilities relate to agent configuration
Paperclip is designed to coordinate AI agents. Both the most severe and the second critical paths depend on a similar core idea: the system imports an agent and then starts it. In the vulnerable scenarios, a malicious agent import can reach a component that launches a configured command as a child process of the server.
That behavior can be legitimate when the imported configuration is trusted. The reported failures were not about the process launcher being inherently unsafe, but about who could supply the configuration and which trust checks were applied before the launcher ran.
Critical server-side path (CVE-2026-41679)
The most severe issue is tracked as CVE-2026-41679 with a CVSS score of 10.0. The report describes an attack against network-accessible Paperclip deployments running in authenticated mode with the default registration configuration.
Notably, the chain does not require a pre-existing account on the target and does not depend on the victim interacting with a malicious page. Instead, the attacker can register through the default open-signup flow, then proceed through the command-line interface (CLI) authorization process.
From there, the attacker can create a pending CLI challenge and approve it, resulting in a durable board API credential. The report states that this credential could then be used through an import path that creates or configures a company in a way that trusted administrator-level assumptions do not hold in the same manner as the normal workflow.
In practical terms, the attacker can supply a bundle (including a YAML configuration) that defines:
- A new company definition
- An agent that uses the process adapter
- The command that the adapter should run
Because the import also makes the attacker a member of the newly created company, a “wakeup” check passes when the attacker starts the agent. Paperclip then launches the specified command with the operating-system privileges of the server process running Paperclip.
What the impact can include depends on the server environment. The analysis notes it could potentially reach application data, source repositories, locally stored credentials, secrets available to agent processes, and internal services reachable from the host.
The fix for CVE-2026-41679
The issue was addressed in the release tagged as v2026.416.0 by tightening the authorization logic for imports. The report says the fix requires:
- instance-administrator access when imports target a new company
- company access when imports target an existing company
The same checks were reported to protect both the import preview and the import execution flow. The report also highlights that open registration can remain enabled, but a newly registered board user should no longer be able to leverage the “new-company import” route as an instance-administrator operation.
As additional context, Rapid7 published a public Metasploit module for automating the CVE-2026-41679 attack chain, and a CISA enrichment carried by NVD classifies exploitation as proof-of-concept. The report states that no exploitation in the wild was reported as of August 5, 2026.
Localhost chain via DNS rebinding (GHSA-x8hx-rhr2-9rf7)
The second critical path is tracked as GHSA-x8hx-rhr2-9rf7 with a CVSS score of 9.6. This path targets a different deployment model: Paperclip running in its default local_trusted configuration.
In local development mode, Paperclip binds to the loopback interface and historically treated any request reaching the service as if it came from an administrator. That reduces authentication friction locally, but the report explains that the “network location” was treated like identity—creating room for bypasses.
The documented scenario uses a DNS rebinding technique. An attacker-controlled hostname is made to resolve to both the attacker’s server and 127.0.0.1. The browser initially loads JavaScript from the attacker’s host; afterward, later requests to the same hostname reach the local Paperclip service.
Because the browser still treats requests as same-origin, Paperclip accepts the attacker-controlled hostname provided in the Host header. From there, the page can call Paperclip’s import API, install a company that includes a process-based agent, and then trigger its wakeup endpoint.
Since local mode effectively assigns administrator authority to these requests, Paperclip may run the attacker’s command with the privileges of the developer’s machine. The report mentions the proof of concept was verified on macOS using Firefox, but it does not establish identical results across all browsers and operating systems.
The fix for the localhost DNS issue
The direct remedy described is hostname validation. In source tagged as v2026.416.0, Paperclip enables a private-hostname guard for private deployments running in either local_trusted or authenticated mode.
The guard is described as running before the middleware that assigns an identity to the request. That means a rebinding request carrying an unapproved hostname can be rejected before the request reaches the relevant API handlers.
API routes missing consistent access checks (GHSA-xfqj-r5qw-8g4j)
A third advisory, GHSA-xfqj-r5qw-8g4j (CVSS score 8.3), focuses on several API routes in authenticated mode. The core theme is that access checks were not consistently enforced for all routes.
One example involves a caller with a valid heartbeat-run identifier retrieving associated issue data without proving access to the company. The report describes this as a targeted disclosure route rather than broad enumeration, because an attacker still needs or must discover a valid run identifier.
Other routes may return:
- agent-facing skill documentation, including API paths and authentication conventions
- health-related details such as deployment mode, version, authentication readiness, bootstrap state, exposure, and feature flags
In addition, the unauthenticated CLI challenge route is referenced as part of the credential-generation chain used in CVE-2026-41679.
The report attributes the gaps to a design behavior where requests could proceed through middleware with a “no actor” identity, leaving it to each route to remember and enforce its own authorization expectations. The changes reported for the fix include adding authentication for general skill routes, enforcing company access checks for heartbeat issue retrieval, applying invite-scoped onboarding constraints, and returning a reduced health response to unauthenticated users.
Upgrading and interpreting version records
A confusing detail in the public records is that the project uses two version labels for the same tagged code. The GitHub security release is referenced as v2026.416.0, while server and CLI manifests inside that tag reportedly show version 0.3.1.
Additionally, the DNS rebinding advisory still reportedly lists no patched version. The Hacker News review of the tagged v2026.416.0 source found that the hostname guard is enabled for private local_trusted deployments, and that the same tagged code requires the correct administrator or company permissions for import paths related to the command execution issue.
Because of mismatched advisory metadata, the safest upgrade guidance in the report is to treat v2026.416.0 (or later) as the upgrade point rather than relying on older affected-version listings in other databases.
What operators should do now
The report concludes that operators should update to v2026.416.0 or later and review how registration and deployment exposure are configured.
Practical next steps include:
- Upgrade Paperclip to v2026.416.0 or later.
- Review whether your deployment uses authenticated mode with default open registration.
- If you use local_trusted, verify hostname validation behavior and limit exposure beyond localhost.
- Assess API access control around company boundaries and run identifiers.
While the report states no authoritative evidence of exploitation in the wild as of August 5, 2026, the impact described—especially where host execution can be triggered—makes timely remediation important.
Conclusion
Paperclip AI flaws demonstrate how quickly “trusted” automation can become dangerous when authorization boundaries are weaker than expected. The reported command-execution paths center on malicious agent imports reaching host execution components, and the additional advisory describes API routes where access checks were not uniformly enforced.
Updating to v2026.416.0 or later and validating your deployment’s exposure and registration settings are the most direct ways to reduce the risk associated with these vulnerabilities.
Source: https://thehackernews.com/2026/08/paperclip-ai-flaws-let-attackers-run.html
