Critical Paperclip AI Flaws Enable Unauthenticated RCE and Agent Takeover

A newly disclosed three critical and high-severity vulnerabilities in Paperclip, an open-source control plane used to orchestrate autonomous “zero-human company” AI agents.

Documented by Oasis, the most severe flaw allows a completely unauthenticated remote attacker to execute arbitrary commands on the host running the Paperclip server.

Tracked as CVE-2026-41679 (CVSS 10.0, GHSA-68qg-g8mg-6pr7), the flaw affects network-accessible authenticated deployments running versions earlier than 2026.416.0 with default registration settings enabled.

Critical Paperclip AI Flaws

The attack begins with Paperclip’s open self-registration, which requires no email verification.

An attacker signs up, then abuses the CLI authorization flow a challenge-and-approval process to self-approve their own request without an independent approver, minting a persistent board-level API credential entirely under their control.

With that token, the attacker exploits a missing authorization boundary in the company-import route. While direct company creation requires instance-administrator privileges, the functionally equivalent import path only requires board-level access.

An attacker-supplied .paperclip.yaml bundle can define an agent using the built-in process adapter, specifying an arbitrary command and arguments.

Paperclip creates the malicious company and agent, grants the attacker access, and once the agent is “woken,” the adapter executes the attacker’s command as the Paperclip server’s OS user, yielding full remote code execution, including exposure of secrets, source code, and internal services reachable from the host.

A second advisory (CVSS 8.3) describes several routes that failed to enforce authentication or company-scoping checks.

Unauthenticated callers could retrieve cross-tenant heartbeat-run issue data, pull agent-facing skill documentation useful for reconnaissance, and read a verbose /api/health response leaking deployment mode, version, and feature flags information that helps attackers fingerprint vulnerable instances.

The third flaw (CVSS 9.6) hits Paperclip’s default local_trusted mode, which implicitly grants administrator identity to any request reaching its loopback-bound service.

Using DNS rebinding, an attacker-controlled webpage can trick a victim’s browser into retargeting same-origin requests to 127.0.0.1 while carrying an attacker-controlled Host header.

Because Paperclip accepted arbitrary Host headers and treated loopback traffic as trusted, the malicious page could silently import and wake a process-based agent, executing commands with the developer’s own privileges, no credentials or cookies required, just a visit to a malicious site.

Oasis stated that all three findings trace to the same pattern: implicit trust assumptions at boundaries a self-issued credential, an unguarded route, or loopback binding substituting for real authorization.

Paperclip patched the import authorization mismatch and company-scoping gaps in version 2026.416.0, and separately hardened local mode (post-0.3.1) with Host-header validation and stricter import controls that block powerful adapters in agent-safe imports.

Operators should upgrade immediately, disable open registration where deployment exposure warrants it, and treat AI agent configurations as executable code requiring the same scrutiny as any privileged deployment artifact.

Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR