Security researchers have disclosed three serious vulnerabilities in Paperclip, an open-source control platform designed to manage teams of AI agents. Two of the flaws could allow attackers to execute malicious commands on either a server or a developer’s local machine, while a third vulnerability may expose sensitive information through improperly protected API endpoints.
Developers and organizations using Paperclip are urged to update immediately, as one of the vulnerabilities has already been weaponized in a public proof-of-concept exploit.
Two Critical Flaws Enable Command Execution
The most severe issue, tracked as CVE-2026-41679, has received a CVSS score of 10.0, the highest possible severity rating. The flaw affects internet-facing Paperclip deployments operating in authenticated mode with the default registration settings.
Researchers found that an attacker could create an account through the platform’s default registration process, import a specially crafted AI agent configuration, and execute arbitrary operating system commands on the server without requiring administrator approval.
A second vulnerability, identified as GHSA-x8hx-rhr2-9rf7 with a CVSS score of 9.6, targets developers running Paperclip locally in its default local_trusted mode.
In this scenario, an attacker only needs to convince a user to visit a malicious website. Once the page is opened, a DNS rebinding attack can redirect browser requests to the victim’s local Paperclip service, allowing the attacker to install a malicious AI agent and execute commands using the developer’s system privileges.
Malicious AI Agent Configurations
According to security researchers at Oasis Security, both attack paths rely on the same underlying weakness: Paperclip treats imported AI agent configurations as executable instructions.
The platform includes a legitimate feature that launches configured commands as child processes. However, the vulnerabilities allowed unauthorized users to supply and activate those configurations.
Researchers warned that AI agent definitions should be considered executable content rather than simple configuration files because they can directly influence how the host system behaves.
Registration Process Opened the Door
In the server-side attack, Paperclip’s default registration workflow unintentionally gave newly created accounts more authority than intended.
Attackers could register without an invitation or verified email address, generate their own API credentials, and import a new company containing a malicious AI agent configured to execute arbitrary commands.
Because the imported company automatically included the attacker as a member, Paperclip accepted the configuration and launched the specified command using the operating system permissions assigned to the Paperclip service.
Depending on the server’s privileges, attackers could potentially access application data, source code repositories, stored credentials, secrets available to AI agents, and internal network resources.
DNS Rebinding Targets Local Developers
The second attack focuses on developers using Paperclip on their personal computers.
Researchers demonstrated that attackers could abuse a DNS rebinding technique to bypass Paperclip’s trust assumptions for localhost connections.
A victim simply visiting an attacker-controlled webpage could unknowingly trigger requests to their own local Paperclip instance. Since earlier versions trusted requests arriving from localhost, the malicious page could install a rogue AI agent and execute commands without requiring authentication tokens or stolen credentials.
The proof of concept was successfully demonstrated on macOS using Firefox, although researchers did not confirm identical behavior across every browser or operating system.
API Weaknesses Could Leak Sensitive Information
Researchers also identified a third vulnerability, GHSA-xfqj-r5qw-8g4j, which received a CVSS score of 8.3.
This flaw affected several API endpoints that failed to consistently enforce authentication and authorization checks.
Under certain conditions, attackers could retrieve issue data associated with valid heartbeat identifiers without proving they belonged to the correct organization.
Other exposed endpoints revealed internal deployment information, including:
- Software version
- Deployment mode
- Authentication status
- Bootstrap state
- Feature flags
- Agent documentation
- Internal API structures
While this issue did not permit unrestricted data access, it provided valuable information that attackers could use during reconnaissance.
Public Exploit Already Available
Security company Rapid7 has released a public Metasploit module that automates exploitation of CVE-2026-41679, making the vulnerability easier for security professionals to test and potentially lowering the barrier for attackers.
The U.S. National Vulnerability Database (NVD), through CISA’s Stakeholder-Specific Vulnerability Categorization (SSVC), classifies the flaw as having publicly available proof-of-concept exploit code.
However, as of August 5, 2026, there have been no confirmed reports of active attacks exploiting these vulnerabilities in real-world environments. Additionally, the flaw has not yet been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
Security Updates Address the Issues
Paperclip addressed the vulnerabilities in version v2026.416.0, which introduces stricter authorization checks for imports, validates hostnames to prevent DNS rebinding attacks, strengthens API authentication, and improves access controls throughout the platform.
Researchers noted that the project uses two different version identifiers for the same release. While GitHub labels the fixed release as v2026.416.0, the application’s internal version number appears as 0.3.1, which has caused some confusion across vulnerability databases.
Users Should Upgrade Immediately
Security experts recommend that all Paperclip deployments upgrade to version v2026.416.0 or later without delay.
Organizations should also review account registration policies, restrict public exposure of Paperclip instances where possible, and verify that imported AI agent configurations come only from trusted sources.
As AI orchestration platforms become increasingly common in enterprise environments, these vulnerabilities highlight the importance of treating AI agent configurations with the same level of scrutiny as executable code.