{"slug": "paperclip-ai-cvss-10-flaw-lets-attackers-run-host-commands", "title": "Paperclip AI CVSS 10 Flaw Lets Attackers Run Host Commands", "summary": "Paperclip, the open-source AI agent orchestration platform with over 53,000 GitHub stars, has a CVSS 10.0 vulnerability (CVE-2026-41679) that allows unauthenticated attackers to execute arbitrary commands on the host server by creating an account, self-approving an API key, and importing a malicious agent bundle. The flaw, patched in v2026.416.0, stems from an authorization mismatch in company creation methods. A second critical flaw enables cross-tenant agent takeover, and a third CVSS 9.6 issue affects local developers via DNS rebinding, patched in Paperclip 0.3.1.", "body_md": "Paperclip — the open-source AI agent orchestration platform that crossed 53,000 GitHub stars in under two months — has a CVSS 10.0 vulnerability. Unauthenticated. No victim interaction required. An attacker on any network-accessible Paperclip instance can create an account, self-approve their own API key, import a malicious agent bundle, and execute arbitrary commands on the host server. Patch is in **v2026.416.0**. Upgrade now, then read on.\n\n## What Paperclip Is (and Why This Matters More Than Most RCEs)\n\nPaperclip is not another chat interface layered over an LLM. It is an orchestration layer that structures AI agents as a working company: org charts, reporting lines, budgets, governance. Agents execute code, read files, call external APIs, and manage workflows — with the Paperclip server acting as the control plane. That design is intentional. It is also what makes a CVSS 10 here particularly consequential: the process running Paperclip has host-level access by design.\n\n## CVE-2026-41679: The Attack Chain\n\nThe root cause is an authorization mismatch that is almost embarrassingly simple. Paperclip offers two ways to create a company on an instance: direct creation (requires instance-admin privileges) and import via `.paperclip.yaml`\n\nbundle (previously only required board-level access). That gap is the vulnerability.\n\nThe six-step exploit requires no special tools:\n\n- Self-register on the target instance — no invite, no email verification in the default configuration\n- Authenticate and obtain a session cookie\n- Create a CLI authentication challenge\n- Self-approve that challenge to obtain a persistent board API key\n- Import a malicious\n`.paperclip.yaml`\n\nbundle that defines an agent using Paperclip built-in process adapter - Trigger the agent — arbitrary OS commands execute as the Paperclip service account\n\nWhat the attacker receives: a shell with the permissions of the service account running Paperclip. Application data, source repositories, secrets, internal services on the same host — all accessible. The fix in [v2026.416.0](https://thehackernews.com/2026/08/paperclip-ai-flaws-let-attackers-run.html) requires instance-administrator access for imports targeting a new company, and company-level access for imports targeting an existing one.\n\n## The Second Flaw: Cross-Tenant Agent Takeover\n\nSeparate from the RCE, a second critical flaw shattered multi-tenant boundaries. Any board-authenticated user in one company on a shared Paperclip instance could act as any agent in a completely different company — by simply supplying a victim agent UUID in the URL path. No scoping check enforced server-side.\n\nSuccessful exploitation let attackers mint API keys for agents in other tenants, execute their workflows, and read their data. This hits teams running shared Paperclip instances hardest: every company on that instance was effectively exposed to every other user on it. Also patched in v2026.416.0.\n\n## The One for Local Developers (CVSS 9.6)\n\nA third flaw, tracked as [GHSA-x8hx-rhr2-9rf7](https://github.com/paperclipai/paperclip/security/advisories/GHSA-x8hx-rhr2-9rf7) (CVSS 9.6), targets Paperclip running in default `local_trusted`\n\nmode — how most developers run it on their machines. The attack: visit an attacker-controlled web page while Paperclip is running on localhost. DNS rebinding lets the attacker JavaScript communicate with the local server and execute commands. No special setup required on the victim machine. Patched in **Paperclip 0.3.1** with hostname validation and restricted adapter imports.\n\n## This Is Becoming a Pattern\n\nThe Paperclip CVSS 10 does not exist in a vacuum. Cursor IDE shipped DuneSlide — two CVSS 9.8 flaws via zero-click prompt injection — in July. An OpenAI agent attacked Hugging Face infrastructure this month. The common thread: AI agent frameworks carry host-level or system-adjacent privileges because they need them to do their jobs. They are being secured, in many cases, like 2018-era web applications.\n\nThe [Gravitee 2026 State of AI Agent Security report](https://www.gravitee.io/state-of-ai-agent-security) (900+ respondents) found 88% of organizations reported confirmed or suspected AI agent security incidents in the past year. 82% of executives feel confident their policies are adequate. 88% experienced incidents those policies did not prevent. That gap is where these vulnerabilities live.\n\nThe Paperclip flaw is not a hallucination problem or a prompt injection edge case. It is a classic web authorization failure — IDOR, authorization bypass — applied to a process that happens to orchestrate agents with host access. If your team is self-hosting agent orchestration infrastructure with network exposure, it deserves the same threat model you would apply to a web server handling financial data. Because that is functionally what it is.\n\n## What to Do\n\n**Upgrade immediately:** v2026.416.0 for network-accessible deployments, 0.3.1 for local mode**Audit your instance configuration:** Check whether open self-registration is enabled. Disable it if network-accessible**Review service account permissions:** Paperclip service account should have minimum necessary OS permissions — treat it like a web server process, not a developer workstation**Shared instances:** Treat all companies on a shared instance as potentially exposed until you confirm you are on v2026.416.0 or later\n\nTechnical details are available via [SecurityWeek](https://www.securityweek.com/critical-paperclip-flaw-allowed-admin-access-code-execution/) and [Endor Labs](https://www.endorlabs.com/vulnerability/cve-2026-41679).", "url": "https://wpnews.pro/news/paperclip-ai-cvss-10-flaw-lets-attackers-run-host-commands", "canonical_source": "https://byteiota.com/paperclip-ai-cvss-10-rce-agent-takeover/", "published_at": "2026-08-09 08:10:10+00:00", "updated_at": "2026-08-09 09:33:41.059610+00:00", "lang": "en", "topics": ["ai-safety", "ai-policy", "ai-infrastructure", "ai-agents"], "entities": ["Paperclip", "CVE-2026-41679", "GHSA-x8hx-rhr2-9rf7", "Cursor IDE", "DuneSlide", "OpenAI", "Hugging Face"], "alternates": {"html": "https://wpnews.pro/news/paperclip-ai-cvss-10-flaw-lets-attackers-run-host-commands", "markdown": "https://wpnews.pro/news/paperclip-ai-cvss-10-flaw-lets-attackers-run-host-commands.md", "text": "https://wpnews.pro/news/paperclip-ai-cvss-10-flaw-lets-attackers-run-host-commands.txt", "jsonld": "https://wpnews.pro/news/paperclip-ai-cvss-10-flaw-lets-attackers-run-host-commands.jsonld"}}