Security researchers are warning against trust assumptions in AI security with newly detailed flaws affecting the open-source AI agent platform Paperclip that could be chained into remote code execution (RCE), data exposure, and developer-machine compromise.
An Oasis Security research shared with CSO ahead of its publication on Wednesday disclosed details of three recent vulnerabilities affecting different Paperclip deployment modes. These include a max-severity authorization bypass issue, multiple improperly protected API endpoints, and a DNS rebinding flaw that enables drive-by RCE against locally deployed instances.
Oasis argues they all stemmed from the same underlying trust assumption Paperclip makes.
“The Paperclip vulnerabilities Oasis Security has disclosed expose something more consequential than a single open-source project: a systemic failure in how AI agent control planes handle identity boundaries,” said Darren Guccione, CEO and co-founder of Keeper Security, who has also reviewed Oasis’ research. “An attacker who gains control of an agent configuration doesn’t just access data; they gain the ability to direct privileged action across every system that agent can reach.”
The flaws are now all patched with fixes shipped in versions 2026.416.0 and 0.3.1.
The most severe finding, tracked as CVE-2026-41679, affected authenticated deployments using Paperclip’s default registration settings.
Oasis found that an attacker could begin as an unauthenticated user, self-register for an account, approve their own command-line (CLI) authorization request, and obtain persistent board-level API access without requiring separate administrative approval.
Basically, an attacker on the internet can simply sign up for an account, immediately log in, and use the account to win board-level permissions through the CLI.
Those permissions were sufficient to exploit another authorization mismatch issue in the platform’s company import workflow, Oasis researchers wrote.
In affected versions, while creating a new company directly required instance administrator privileges, importing a company enforced only board-level permissions. Because imported company bundles could include executable agent definitions, an attacker could upload a malicious “.paperclip.yaml” file specifying a process-based agent, then trigger that agent to execute arbitrary operating system commands under the Paperclip server’s privileges.
Oasis warned that this is why AI agent configuration should be treated as executable input rather than simple data. Paperclip did not immediately respond to CSO’s requests for comments.
Other than the critical RCE chain, Oasis disclosed two vulnerabilities that highlight the same architectural flaws.
One is about several API endpoints that either lacked authentication or failed to enforce tenant-level authorization, exposing workflow information, skill documentation, and deployment metadata that could aid attackers in reconnaissance or cross-tenant information disclosure.
The other issue (CVSS 9.6) affected Paperclip’s default “local_trusted” deployment mode, where the platform assumed requests reaching localhost originated from trusted software. Oasis demonstrated that a DNS rebinding attack could violate that assumption, allowing an attacker-controlled webpage to communicate with the local Paperclip service and ultimately execute commands on a developer’s machine after importing and triggering a malicious agent.
Paperclip patched the RCE path and the leaking APIs issues in version 2026.416.0 by requiring administrator privileges for new-company imports, strengthening authorization checks across related operations, and adding regression tests.
The third issue was addressed in Paperclip 0.3.1 by enabling hostname validation, hardening imports, and restricting risky adapters in agent-safe imports.
Guccione argues that traditional access controls are ill-suited for autonomous agents. “The security question is no longer whether a credential is valid at the point of entry,” he said. “It’s whether the agent invoking that credential is doing so within the intended scope, for the intended purpose, under the authority of a human who would sanction that action.”