Paperclip flaws expose agent imports to host command execution
Three security flaws in the open-source AI-agent control plane Paperclip could allow attackers to execute host commands, expose sensitive control-plane data, or bypass expected access checks. The most severe issue, CVE-2026-41679, has a CVSS score of 10.0 and affects network-accessible authenticated deployments using the vulnerable default registration configuration.
A second issue, GHSA-x8hx-rhr2-9rf7, has a CVSS score of 9.6. It can be triggered when a victim opens an attacker-controlled page while Paperclip runs in its default local_trusted mode. Paperclip v2026.416.0 includes the import-authorisation and hostname-validation protections described in the advisories; its manifests identify the same tagged code as version 0.3.1.
Malicious agent configuration reaches the process adapter
Oasis Security found that both command-execution paths rely on importing an attacker-controlled agent and starting it. Paperclip’s built-in process adapter is intended to launch a configured command as a child process of the server. The problem was not that process execution existed, but that insufficiently trusted users or browser-originated requests could supply configuration that reached that adapter.
For CVE-2026-41679, an attacker could use open signup to register, create and approve a pending command-line interface challenge, and obtain a durable board API credential. Although direct company creation required instance-administrator rights, the new-company import route accepted board-level access. A crafted .paperclip.yaml bundle could define a company, a process-based agent and a command. Once the attacker started the agent, Paperclip launched that command with the operating-system privileges of its server process.
Paperclip now requires instance-administrator access for imports into a new company and company access for imports into an existing one. Those checks apply to both import preview and execution. Rapid7 released a Metasploit module that automates the six-request attack chain. NVD’s CISA-ADP enrichment classifies the issue as automatable, with proof-of-concept exploitation, while no authoritative report reviewed on August 5, 2026 documented exploitation in the wild.
DNS rebinding turns localhost trust into execution
The local path used a DNS rebinding scenario against the default local_trusted configuration. Paperclip bound to loopback and historically treated requests reaching that service as implicitly instance-administrator requests. An attacker-controlled hostname could first serve browser JavaScript and later resolve to 127.0.0.1. The browser retained the same-origin relationship while Paperclip accepted the attacker’s hostname in its Host header.
The page could then call the import API, install a process-based agent and invoke its wakeup endpoint. Paperclip would run the command with the developer’s privileges, without requiring a Paperclip token, session cookie or stolen credential. Oasis verified its proof of concept on macOS with Firefox; the public record does not establish identical end-to-end results across every browser and operating system.
Version v2026.416.0 enables a private-hostname guard for private deployments in both local_trusted and authenticated modes. The guard rejects an unapproved hostname before identity-assignment middleware and the API. The same release also blocks process and HTTP adapters from the restricted agent-safe import path.
Route checks and upgrade priorities
A third advisory, GHSA-xfqj-r5qw-8g4j with CVSS 8.3, covers authenticated-mode API routes that did not consistently reject unauthenticated or cross-company access. A valid heartbeat-run identifier could disclose associated issue data, while other routes exposed agent skill documentation or health details, including deployment mode, version, authentication readiness and feature flags.
The pattern matches borrowed trust in cybersecurity controls because credentials, routes and network location all received trust beyond the scope required for later actions. Paperclip added authentication to general skill routes, company-access checks for heartbeat issue retrieval, invite-scoped onboarding routes and a reduced unauthenticated health response.
Businesses operating Paperclip should upgrade to v2026.416.0 or later, review open registration and deployment exposure, and assess agent definitions as executable input. The practical control is to ensure authorisation is enforced at import, activation and API stages rather than inferred from a credential or localhost location alone.