Two security flaws in Paperclip could let attackers execute commands on a network server or a developer’s computer. Paperclip is an open-source control plane for teams of artificial intelligence (AI) agents, and both paths rely on importing a malicious agent and starting it.
A third flaw could expose sensitive data and control-plane details through application programming interface (API) routes that did not enforce the expected access checks.
The more severe server-side path, tracked as CVE-2026-41679 (CVSS score: 10.0), requires no pre-existing account or victim interaction against network-accessible deployments using authenticated mode with the default registration configuration.
The second path, tracked as GHSA-x8hx-rhr2-9rf7 (CVSS score: 9.6), requires a user to open an attacker-controlled page while Paperclip is running in its default local_trusted mode.
The source tagged as Paperclip v2026.416.0 contains the import-authorization fix and hostname-validation guard discussed below, although the DNS-rebinding advisory does not identify a patched version. Rapid7 has since shipped a public Metasploit module for CVE-2026-41679, and CISA’s Stakeholder-Specific Vulnerability Categorization (SSVC) enrichment carried by NVD classifies exploitation as proof-of-concept.
No authoritative source reviewed by The Hacker News reported exploitation in the wild as of August 5, 2026. Operators should update to v2026.416.0 or later and review how registration and deployment exposure are configured.
Oasis Security’s analysis, backed by a 17-page technical report, connects the findings through one product property: agent configuration can become executable behavior. Paperclip’s built-in process adapter intentionally launches a configured command as a child process of the server.
The execution feature is legitimate. The vulnerabilities changed who could reach it and whose configuration the server would trust.
“Agent configuration must be treated as executable input,” Oasis said.
Unauthorized users or browser-originated requests could introduce and activate configuration that reached the launcher.
The server-side chain applies to network-accessible authenticated deployments using the vulnerable registration configuration. The localhost chain applies when a user opens an attacker-controlled page while Paperclip is running in its default local_trusted configuration. Both end with attacker-controlled agent configuration reaching the host execution adapter.
A Board Key Approved by Its Owner
The attack against an internet-accessible instance begins with Paperclip’s default open-signup flow. An attacker can register without an invitation or verified email address, sign in, and enter the command-line interface authorization process. The same newly registered user could create a pending CLI challenge and approve it, activating a durable board API credential without a separate administrator making the decision.
That credential should not have been enough to create a top-level company. Paperclip required instance-administrator rights when a user created a company directly, but the equivalent new-company import route accepted board-level access.
An attacker could therefore supply a .paperclip.yaml bundle defining a new company, an agent using the process adapter, and the command that agent would run.
The import also made the attacker a member of the new company, so the normal wakeup check passed when the attacker started the agent. Paperclip then launched the command with the operating-system privileges of its server process.
The practical impact depends on the service account and host. Oasis said it could include application data, source repositories, locally stored credentials, secrets available to agent processes, and internal services reachable from the machine.
Paperclip fixed CVE-2026-41679 in v2026.416.0 by requiring instance-administrator access for imports targeting a new company and company access for imports targeting an existing one. The same check now protects both import preview and execution.
Open registration remains available, but a newly registered board user can no longer treat the new-company import route as an instance-administrator operation.
Rapid7 published a Metasploit module in June 2026 that automates the six-request CVE-2026-41679 attack chain. The CISA-ADP enrichment carried by NVD marks the flaw as automatable, with total technical impact and proof-of-concept exploitation.
The vulnerability was not listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog when The Hacker News checked it on August 5, 2026. Absence from KEV does not rule out exploitation.
The Browser Crosses Into Localhost
The second critical path targets a different deployment model. In its default local_trusted configuration, Paperclip binds to the loopback interface and historically treated every request reaching the service as an implicit instance administrator. That removed authentication friction for local development, but it also treated network location as identity.
Oasis demonstrated a Domain Name System (DNS) rebinding attack in which an attacker-controlled hostname resolved to both the attacker’s server and 127.0.0.1. The browser first loaded JavaScript from the attacker’s server. After that server stopped responding, later requests to the same hostname reached the local Paperclip service.
The browser still considered the requests same-origin, and Paperclip accepted the attacker’s hostname in the Host header. The page could then call Paperclip’s import API, install a company containing a process-based agent, and invoke its wakeup endpoint.
Because local mode assigned administrator authority to the rebound requests, the server ran the attacker’s command with the developer’s privileges. No Paperclip token, session cookie, or stolen credential was required. The documented proof of concept was verified on macOS with Firefox, so the public record does not establish the same end-to-end result across every browser and operating system.
The direct fix was hostname validation. Paperclip’s source tagged as v2026.416.0 enables the private-hostname guard for private deployments running in either local_trusted or authenticated mode. The guard runs before the middleware that assigns an identity to the request, causing a rebound request carrying an unapproved hostname to be rejected before it reaches the API.
Routes Left Without Their Guards
The third advisory, GHSA-xfqj-r5qw-8g4j (CVSS score: 8.3), covers several API routes in authenticated mode that did not consistently reject unauthenticated or cross-company requests.
A caller with a valid heartbeat-run identifier could retrieve its associated issue data without proving access to the company. This was a targeted disclosure path, not unrestricted enumeration, because the caller still needed to obtain or discover a valid run identifier.
Other exposed routes returned Paperclip’s agent-facing skill documentation, including API paths and authentication conventions, or disclosed health information such as deployment mode, version, authentication readiness, bootstrap state, exposure, and feature flags. The unauthenticated CLI challenge route also formed part of the credential-generation chain used by CVE-2026-41679.
The underlying design allowed an unauthenticated request to continue through middleware with a “no actor” identity, leaving each route to remember its own assertion. Paperclip added authentication to general skill routes, company-access checks to heartbeat issue retrieval, invite-scoped onboarding routes, and a reduced health response for unauthenticated users.
Across the three findings, Paperclip trusted a credential, a route, or a network location without applying the check the later operation required. The concrete failures were self-approved credentials, missing route checks, and trusted-localhost assumptions.
The Records Do Not Line Up
Paperclip uses two version labels for the same tagged code. The GitHub security release is v2026.416.0, while the server and CLI manifests inside that tag report version 0.3.1. That dual labeling appears to explain why the advisories refer to both 0.3.1 and 2026.416.0.
The DNS-rebinding advisory still lists no patched version. A review by The Hacker News of the tagged v2026.416.0 source found the hostname guard enabled for private local_trusted deployments. The same tagged code requires instance-administrator rights for a new-company import and blocks process and HTTP adapters from the restricted agent-safe import path.
The records still do not line up. The code tagged as v2026.416.0 contains the relevant fixes, while the DNS-rebinding advisory still lacks a patched-version entry and NVD retains older affected-version metadata in its history. For operators, the safest reading is to use v2026.416.0 or later as the upgrade point rather than rely on the older metadata.
Paperclip’s release notes tell all deployments to upgrade, and Oasis recommends v2026.416.0 or later.
