Paperclip AI CVSS 10 Flaw Lets Attackers Run Host Commands

Paperclip, the open-source AI agent orchestration platform with over 53,000 GitHub stars, has a CVSS 10.0 vulnerability (CVE-2026-41679) that allows unauthenticated attackers to execute arbitrary commands on the host server by creating an account, self-approving an API key, and importing a malicious agent bundle. The flaw, patched in v2026.416.0, stems from an authorization mismatch in company creation methods. A second critical flaw enables cross-tenant agent takeover, and a third CVSS 9.6 issue affects local developers via DNS rebinding, patched in Paperclip 0.3.1.

Paperclip — the open-source AI agent orchestration platform that crossed 53,000 GitHub stars in under two months — has a CVSS 10.0 vulnerability. Unauthenticated. No victim interaction required. An attacker on any network-accessible Paperclip instance can create an account, self-approve their own API key, import a malicious agent bundle, and execute arbitrary commands on the host server. Patch is in v2026.416.0 . Upgrade now, then read on. What Paperclip Is and Why This Matters More Than Most RCEs Paperclip is not another chat interface layered over an LLM. It is an orchestration layer that structures AI agents as a working company: org charts, reporting lines, budgets, governance. Agents execute code, read files, call external APIs, and manage workflows — with the Paperclip server acting as the control plane. That design is intentional. It is also what makes a CVSS 10 here particularly consequential: the process running Paperclip has host-level access by design. CVE-2026-41679: The Attack Chain The root cause is an authorization mismatch that is almost embarrassingly simple. Paperclip offers two ways to create a company on an instance: direct creation requires instance-admin privileges and import via .paperclip.yaml bundle previously only required board-level access . That gap is the vulnerability. The six-step exploit requires no special tools: - Self-register on the target instance — no invite, no email verification in the default configuration - Authenticate and obtain a session cookie - Create a CLI authentication challenge - Self-approve that challenge to obtain a persistent board API key - Import a malicious .paperclip.yaml bundle that defines an agent using Paperclip built-in process adapter - Trigger the agent — arbitrary OS commands execute as the Paperclip service account What the attacker receives: a shell with the permissions of the service account running Paperclip. Application data, source repositories, secrets, internal services on the same host — all accessible. The fix in v2026.416.0 https://thehackernews.com/2026/08/paperclip-ai-flaws-let-attackers-run.html requires instance-administrator access for imports targeting a new company, and company-level access for imports targeting an existing one. The Second Flaw: Cross-Tenant Agent Takeover Separate from the RCE, a second critical flaw shattered multi-tenant boundaries. Any board-authenticated user in one company on a shared Paperclip instance could act as any agent in a completely different company — by simply supplying a victim agent UUID in the URL path. No scoping check enforced server-side. Successful exploitation let attackers mint API keys for agents in other tenants, execute their workflows, and read their data. This hits teams running shared Paperclip instances hardest: every company on that instance was effectively exposed to every other user on it. Also patched in v2026.416.0. The One for Local Developers CVSS 9.6 A third flaw, tracked as GHSA-x8hx-rhr2-9rf7 https://github.com/paperclipai/paperclip/security/advisories/GHSA-x8hx-rhr2-9rf7 CVSS 9.6 , targets Paperclip running in default local trusted mode — how most developers run it on their machines. The attack: visit an attacker-controlled web page while Paperclip is running on localhost. DNS rebinding lets the attacker JavaScript communicate with the local server and execute commands. No special setup required on the victim machine. Patched in Paperclip 0.3.1 with hostname validation and restricted adapter imports. This Is Becoming a Pattern The Paperclip CVSS 10 does not exist in a vacuum. Cursor IDE shipped DuneSlide — two CVSS 9.8 flaws via zero-click prompt injection — in July. An OpenAI agent attacked Hugging Face infrastructure this month. The common thread: AI agent frameworks carry host-level or system-adjacent privileges because they need them to do their jobs. They are being secured, in many cases, like 2018-era web applications. The Gravitee 2026 State of AI Agent Security report https://www.gravitee.io/state-of-ai-agent-security 900+ respondents found 88% of organizations reported confirmed or suspected AI agent security incidents in the past year. 82% of executives feel confident their policies are adequate. 88% experienced incidents those policies did not prevent. That gap is where these vulnerabilities live. The Paperclip flaw is not a hallucination problem or a prompt injection edge case. It is a classic web authorization failure — IDOR, authorization bypass — applied to a process that happens to orchestrate agents with host access. If your team is self-hosting agent orchestration infrastructure with network exposure, it deserves the same threat model you would apply to a web server handling financial data. Because that is functionally what it is. What to Do Upgrade immediately: v2026.416.0 for network-accessible deployments, 0.3.1 for local mode Audit your instance configuration: Check whether open self-registration is enabled. Disable it if network-accessible Review service account permissions: Paperclip service account should have minimum necessary OS permissions — treat it like a web server process, not a developer workstation Shared instances: Treat all companies on a shared instance as potentially exposed until you confirm you are on v2026.416.0 or later Technical details are available via SecurityWeek https://www.securityweek.com/critical-paperclip-flaw-allowed-admin-access-code-execution/ and Endor Labs https://www.endorlabs.com/vulnerability/cve-2026-41679 .