Recent disclosures have unveiled critical security flaws in Paperclip, an AI agent orchestration platform, which could enable attackers to obtain administrative access and execute commands on compromised servers.
Understanding Paperclip’s Functionality
Paperclip is designed to assist organizations in managing autonomous AI agents through the use of companies, tasks, adapters, and configurable workflows. A notable feature allows users to import company bundles containing .paperclip.yaml files. These files define agents, their execution adapters, and the commands they execute, transforming a seemingly straightforward configuration import into a potential security risk.
Details of the Critical Vulnerability
The most severe vulnerability, identified as CVE-2026-41679 with a CVSS score of 10.0, affects network-accessible Paperclip deployments utilizing the default authenticated configuration. This flaw arises from an authorization mismatch within the platform. While creating a company directly requires instance-administrator permissions, the import route permitted users with lower board-level access to import a new company. Exploiting this discrepancy, an attacker could create a company containing a malicious agent configuration.
The attack sequence begins with open registration, allowing a remote attacker to register an account without email verification. After signing in, the attacker can create a CLI authorization challenge and approve it using the same account. This process activates a persistent board API token, effectively granting elevated API access without an independent approval step. Utilizing this token, the attacker can access the company import route and upload a crafted bundle.
The malicious .paperclip.yaml file can configure an agent to use Paperclip’s built-in process adapter, which launches commands as child processes on the host server. Upon importing the company, the attacker can activate the agent, causing Paperclip to execute the specified command. Successful exploitation would grant the attacker the permissions of the operating system account running Paperclip, potentially exposing application data, source code repositories, local credentials, secrets accessible to agent processes, and internal services reachable from the host.
Additional Security Flaws
Two other vulnerabilities further exacerbate the risk. The first involves API endpoints that did not consistently enforce authentication or company-level authorization, exposing heartbeat issue data, agent skill documentation, and health information. This could reveal deployment details, feature flags, authentication readiness, and the installed version.
The second critical issue affects Paperclip’s local_trusted mode, where the service binds to 127.0.0.1 and assumes incoming requests originate from trusted local software. Researchers discovered that a DNS rebinding attack could exploit this assumption. An attacker-controlled website could use browser-based requests to reach the local Paperclip API, treating them as administrator actions. The attacker could then import and activate a malicious agent, resulting in command execution on the developer’s machine.
Mitigation Measures
In response to these vulnerabilities, Paperclip has implemented several security enhancements:
- Requiring stronger authorization for new company imports.
- Tightening company-scoping checks.
- Protecting previously exposed API routes.
- Adding hostname validation in locally trusted deployments.
Organizations are strongly advised to upgrade immediately, restrict public registration where unnecessary, review imported agent configurations, and treat agent adapters and command fields as privileged executable code.
These vulnerabilities underscore the critical importance of robust authorization mechanisms and thorough input validation in platforms managing autonomous agents. As AI systems become increasingly integrated into organizational infrastructures, ensuring their security is paramount to prevent potential exploitation and maintain trust in these technologies.
