Critical Paperclip AI Flaws Allow Remote Code Execution on Autonomous Agent Servers

Security researchers have disclosed three critical and high-severity vulnerabilities affecting Paperclip, an open-source control plane designed to orchestrate autonomous AI agents operating within so-called “zero-human companies.”

The vulnerabilities expose serious weaknesses in authentication, authorization, tenant isolation, and local trust mechanisms.

The most severe issue could allow a completely unauthenticated remote attacker to eventually execute arbitrary operating-system commands on a vulnerable Paperclip server, potentially exposing credentials, source code, internal services, and other sensitive resources accessible to the application.

Critical Paperclip AI Flaws

The most dangerous vulnerability is tracked as CVE-2026-41679, with a maximum CVSS score of 10.0 and advisory identifier GHSA-68qg-g8mg-6pr7.

According to research documented by Oasis, the vulnerability affects certain network-accessible Paperclip deployments running versions earlier than 2026.416.0 when default registration functionality remains enabled.

Exploitation involves chaining multiple weaknesses rather than relying on a conventional single-step command injection.

The attack begins with Paperclip’s open self-registration mechanism, which does not require email verification. After registering, an attacker can manipulate the CLI authorization workflow, which normally uses a challenge-and-approval process.

Researchers found that an attacker could effectively approve their own authorization request without requiring an independent administrator, resulting in the creation of a persistent board-level API credential controlled by the attacker.

The credential alone should not provide permission to create privileged companies. However, researchers discovered an authorization inconsistency within Paperclip’s company-import functionality.

While directly creating a company requires instance-administrator privileges, the functionally similar import endpoint accepted board-level authorization.

This authorization mismatch enables the attacker to supply a malicious .paperclip.yaml configuration bundle.The malicious configuration can define an AI agent using Paperclip’s built-in process adapter, including attacker-selected commands and arguments.

Once Paperclip imports the company and the malicious agent is subsequently “woken,” the process adapter executes those commands with the privileges of the operating-system account running the Paperclip server.

Successful exploitation therefore results in remote code execution, potentially allowing attackers to access environment secrets, application source code, credentials, files, databases, or internal network services reachable from the compromised host.

Researchers separately documented an 8.3-rated vulnerability class involving API routes that failed to properly enforce authentication or company-scoping restrictions.

Unauthenticated attackers could potentially obtain cross-tenant heartbeat-run issue information and access agent-oriented skill documentation useful for reconnaissance.

A verbose /api/health response could additionally disclose information such as deployment mode, software version, and enabled feature flags, helping attackers fingerprint exposed Paperclip installations.

A third vulnerability, rated CVSS 9.6, targets Paperclip’s default local_trusted operating mode. The configuration implicitly trusts requests reaching the loopback-bound service and assigns administrator-level identity without conventional authentication. Researchers demonstrated how DNS rebinding could undermine this assumption.

An attacker-controlled webpage could cause a victim’s browser to redirect same-origin requests toward 127.0.0.1. Because vulnerable Paperclip versions accepted arbitrary Host headers while trusting loopback traffic, a malicious website could potentially interact with the locally running service.

This could allow the attacker to import and activate a process-based agent that executes commands using the developer’s own operating-system privileges, without stealing cookies or credentials.

The three vulnerabilities demonstrate a recurring security challenge for autonomous-agent platforms: configuration data can effectively become executable code when agents are capable of launching local processes or invoking privileged tools.

Trusting registration workflows, API routes, tenant identifiers, or loopback networking without independent authorization controls can therefore create dangerous privilege boundaries.

Paperclip operators should upgrade immediately to patched releases, including version 2026.416.0 or later where applicable, and deploy subsequent local-mode security improvements.

Administrators should disable unnecessary open registration, restrict network exposure, review existing API credentials, and audit imported agent configurations.

Organizations deploying autonomous AI infrastructure should ultimately treat agent definitions and adapters with the same security scrutiny applied to privileged scripts, CI/CD pipelines, and executable deployment artifacts.