Paperclip AI Flaws Let Attackers Run Host Commands via Malicious Agent Imports
Paperclip AI, an open-source control plane for AI agent teams, contains two critical vulnerabilities (CVE-2026-41679, CVSS 10.0; GHSA-x8hx-rhr2-9rf7, CVSS 9.6) that allow remote command execution on host servers or developer machines via malicious agent imports The server-side flaw exploits Paperclip's default open-signup registration flow, allowing unauthenticated attackers to self-register, approve their own CLI authorization, and import a malicious agent bundle that executes arbitrary command
62
Hot
58
Quality
60
Impact
Analysis
TL;DR
- Paperclip AI, an open-source control plane for AI agent teams, contains two critical vulnerabilities (CVE-2026-41679, CVSS 10.0; GHSA-x8hx-rhr2-9rf7, CVSS 9.6) that allow remote command execution on host servers or developer machines via malicious agent imports
- The server-side flaw exploits Paperclip's default open-signup registration flow, allowing unauthenticated attackers to self-register, approve their own CLI authorization, and import a malicious agent bundle that executes arbitrary commands with server privileges
- The localhost flaw leverages DNS rebinding attacks against Paperclip's default local_trusted mode, which treats all loopback requests as implicit administrator access, enabling browser-based exploitation without any stolen credentials
- A third vulnerability exposes sensitive data and control-plane details through API routes lacking proper access enforcement
- Rapid7 has released a public Metasploit module automating the server-side attack chain, and operators are urged to update to v2026.416.0 or later
Why It Matters
This incident demonstrates a critical class of vulnerabilities in AI agent orchestration platforms where agent configuration is effectively executable input, blurring the line between data and code. For AI practitioners deploying agent teams, it highlights that security assumptions around local development modes and open registration flows can lead to complete host compromise. The availability of a public Metasploit module and proof-of-concept exploitation makes this an urgent remediation priority for any organization running Paperclip.
Technical Details
- CVE-2026-41679 (CVSS 10.0): An unauthenticated remote code execution vulnerability affecting network-accessible Paperclip deployments using authenticated mode with default registration configuration. The attack chain involves: (1) registering via the open-signup flow without invitation or email verification, (2) creating and approving a pending CLI challenge to obtain a board-level API credential, (3) exploiting an authorization bypass where the new-company import route accepts board-level access instead of requiring instance-administrator rights, and (4) importing a .paperclip.yaml bundle containing a process-adapter agent configured to execute arbitrary commands. The fix in v2026.416.0 enforces instance-administrator access for imports targeting new companies and company access for existing ones.
- GHSA-x8hx-rhr2-9rf7 (CVSS 9.6): A DNS rebinding attack targeting Paperclip's default local_trusted mode, which binds to the loopback interface and treats all requests as implicit instance administrator access. The attack uses an attacker-controlled hostname that resolves alternately to the attacker's server and 127.0.0.1, allowing JavaScript to make same-origin requests to the local Paperclip service. The browser maintains same-origin trust while the Host header contains the attacker's hostname, which Paperclip accepts. The proof of concept was verified on macOS with Firefox.
- Third vulnerability (untracked CVE): API routes exposing sensitive data and control-plane details without enforcing expected access checks, enabling information disclosure.
- Core architectural issue: Paperclip's built-in process adapter intentionally launches configured commands as child processes of the server. The vulnerabilities exploit the fact that agent configuration can become executable behavior when authorization boundaries are insufficient.
- Mitigation: Update to Paperclip v2026.416.0 or later, which adds import-authorization fixes and hostname-validation guards. Operators should review registration and deployment exposure configurations.
Industry Insight
- AI agent orchestration platforms must adopt a "configuration as executable input" security model, where any agent configuration that reaches a process launcher is subject to the same rigorous validation and authorization controls as user-supplied code. The convergence of agent configuration and system execution creates a unique attack surface that traditional web application security models do not adequately address.
- Default configurations in developer-facing AI tools often prioritize convenience over security, as demonstrated by Paperclip's local_trusted mode treating network location as identity. Security teams should audit default configurations of all AI infrastructure tools and enforce least-privilege principles even in local development environments, recognizing that DNS rebinding and similar techniques can bypass localhost assumptions.
- The rapid publication of a Metasploit module by Rapid7 and CISA's SSVC enrichment marking this as automatable with proof-of-concept exploitation signals that this vulnerability will see active exploitation in the wild. Organizations running Paperclip should treat this as an emergency patching priority and conduct immediate inventory reviews of all Paperclip deployments, particularly those exposed to the internet or used in shared development environments.
Disclaimer: The above content is generated by AI and is for reference only.
Security Open Source Agent LLM
Related Articles
[GitHub] apache/texera
Rogue AI agents created fake online identities in another hacking attempt
Mistral's open model Shieldstral matches much larger safety models at a fraction of the size
AI Cyber Range Architecture: Test Security Agents Without Touching Real Systems
Show HN: Everfree - AI Cowriter Note App on GitHub Backend & Evernote Migration