Recent security assessments have uncovered critical vulnerabilities in Paperclip, an open-source control plane designed for managing teams of artificial intelligence (AI) agents. These flaws could enable attackers to execute arbitrary commands on network servers or developers’ local machines by importing malicious agents and initiating them.
The most severe of these vulnerabilities, identified as CVE-2026-41679 with a CVSS score of 10.0, allows unauthenticated attackers to execute commands on network-accessible deployments that use the default registration configuration. This flaw does not require prior user interaction, making it particularly dangerous for publicly accessible instances of Paperclip.
Another significant vulnerability, tracked as GHSA-x8hx-rhr2-9rf7 with a CVSS score of 9.6, necessitates user interaction. In this scenario, if a developer opens a malicious webpage while Paperclip is running in its default local_trusted mode, the attacker can exploit this to execute commands on the developer’s machine.
A third vulnerability exposes sensitive data and control-plane details through API routes that lack proper access controls. This flaw could lead to unauthorized access to critical information, further compromising the security of the system.
These vulnerabilities stem from the way Paperclip handles agent configurations, which can be manipulated to execute arbitrary commands. The built-in process adapter in Paperclip is designed to launch configured commands as child processes of the server. However, the identified flaws allow unauthorized users or browser-originated requests to introduce and activate configurations that reach the execution adapter, leading to potential exploitation.
For instance, in the case of CVE-2026-41679, an attacker can register a new account without an invitation or verified email address due to Paperclip’s default open-signup flow. Once registered, the attacker can create a pending command-line interface (CLI) challenge and approve it themselves, thereby obtaining a durable board API credential. This credential can then be used to import a malicious agent configuration that, when activated, executes arbitrary commands on the host system with the same privileges as the Paperclip server process.
To mitigate these risks, it is crucial for operators to update to Paperclip version v2026.416.0 or later, which includes fixes for these vulnerabilities. Additionally, reviewing and adjusting registration and deployment exposure configurations can help prevent unauthorized access and potential exploitation.
These vulnerabilities highlight the importance of treating agent configurations as executable inputs and ensuring that proper access controls and validation mechanisms are in place. As AI systems become more integrated into various applications, securing their control planes is essential to prevent potential exploitation and maintain the integrity of the systems they manage.
