Paperclip Flaw Opens AI Agent Gateways

Security researchers have identified a critical vulnerability within Paperclip, an AI management platform designed to orchestrate autonomous agents. The flaw potentially granted remote attackers the ability to achieve arbitrary code execution by exploiting a series of authorization failures, according to a technical report published by Oasis Security.

Understanding the Critical Flaw

The vulnerability, tracked as CVE-2026-41679, carries a maximum CVSS score of 10. It primarily affected network-accessible instances of Paperclip configured in default authenticated-mode. The core issue stemmed from a missing authorization check during the account registration and CLI authorization process.

By failing to require email verification, the platform allowed unauthorized users to self-register accounts. Once authenticated, an attacker could navigate through the CLI challenge-and-approval flow to obtain a board-level API token. This token provided the necessary access to reach company import routes, which were improperly secured against non-administrative users.

A network attacker could create an account and sign in immediately, without an invitation or control of a verified mailbox. That session was enough to enter Paperclip’s CLI authorization flow, a challenge-and-approval process used to authorize a command-line client and activate a persistent board API credential.

— Oasis Security, in a technical report

Mechanics of Code Execution

Once an attacker gained board-level access, they could initiate a company import. The platform failed to restrict this path to instance administrators, allowing any board-level user to proceed. During the import, an attacker could supply a crafted .paperclip.yaml file to define a malicious agent.

This agent could be configured to utilize a host-level execution adapter, which would then execute commands as the Paperclip server process. Depending on the specific deployment, this level of access could expose application data, source repositories, internal services, and local credentials or secrets.

Additional Security Weaknesses

Beyond the primary authorization bypass, Oasis Security discovered two further security issues within the platform:

• A missing authorization check on API routes that could lead to sensitive data disclosure.
• A DNS rebinding vulnerability on loopback addresses that potentially allowed remote code execution on developer machines.

The DNS rebinding issue existed because Paperclip, when running in local-development mode, would bind to 127.0.0.1 and inherently trust all requests directed at that address. By tricking a developer into loading a malicious website, an attacker could bypass same-origin protections and manipulate the local API to execute commands.

Mitigation and Remediation

Paperclip has addressed these vulnerabilities by implementing stricter authorization checks across the import preview and execution flows. The company also tightened the scoping for company imports to ensure only authorized administrators can perform sensitive operations. Developers are encouraged to ensure their instances are updated to the latest version to mitigate the risks associated with the DNS rebinding and API authorization flaws.

Implications for AI Security

The discovery highlights the expanding attack surface as organizations increasingly adopt agentic workflows. Because these systems are distributed, intent is often delegated across multiple agents, each potentially utilizing different credentials. This complexity can obscure the audit trail, as final logs may only show the end-stage credential rather than the originating user or the specific task being performed.

This suggests that as AI agents become a new class of enterprise identity, traditional security perimeters may struggle to maintain visibility. The reliance on automated, board-level API interactions necessitates a more granular approach to authorization and identity management to prevent similar escalation paths in the future.