Paperclip AI Flaws Let Attackers Run Host Commands via Malicious Agent Imports

Summary

Oasis Security disclosed three vulnerabilities in Paperclip, an open-source control plane for teams of AI agents. Two are critical remote-code-execution paths that both end with attacker-controlled agent configuration reaching Paperclip's process adapter, which by design launches a configured command as a child process of the server. CVE-2026-41679 (CVSS 10.0) affects network-accessible authenticated deployments using the default registration configuration, while GHSA-x8hx-rhr2-9rf7 (CVSS 9.6) targets the default local_trusted mode via a DNS-rebinding attack.^[1]

A third advisory, GHSA-xfqj-r5qw-8g4j (CVSS 8.3), documents API routes in authenticated mode that failed to consistently enforce access checks, exposing issue data, agent-facing skill documentation, and deployment health details. Paperclip addressed the import-authorization and hostname-validation issues in the source tagged v2026.416.0, though the DNS-rebinding advisory still lists no patched version and version metadata is inconsistent.^[1]

Exploitation maturity is elevated: Rapid7 shipped a public Metasploit module automating the CVE-2026-41679 chain, and CISA's SSVC enrichment carried by NVD rates the flaw as automatable with total technical impact and proof-of-concept exploitation. However, no authoritative source reported in-the-wild exploitation and the CVE was absent from CISA KEV as of August 5, 2026.^[1][2]

Attack chain

1. Registration and credential self-approval: Against an internet-accessible authenticated instance, an attacker uses Paperclip's default open-signup flow to register without an invitation or verified email, signs in, then creates a pending CLI challenge and approves it themselves, activating a durable board API credential without a separate administrator decision.^[1]
2. Privilege gap in import route: Although creating a company directly required instance-administrator rights, the equivalent new-company import route accepted board-level access, letting the attacker supply a .paperclip.yaml bundle defining a new company, an agent using the process adapter, and the command to run. The import also made the attacker a member of the new company so the wakeup check passed.^[1]
3. Command execution on host: Paperclip launched the configured command with the operating-system privileges of its server process, potentially exposing application data, source repositories, locally stored credentials, secrets available to agent processes, and internal services reachable from the machine.^[1]
4. Alternative: DNS-rebinding into localhost: In default local_trusted mode Paperclip binds to loopback and treated every reaching request as an implicit instance administrator. An attacker-controlled hostname resolving to both the attacker server and 127.0.0.1 lets a browser load attacker JavaScript, then reach the local service same-origin; the page calls the import API, installs a process-based agent, and invokes wakeup, running the attacker's command with the developer's privileges without any token or stolen credential.^[1]

Disclosure timeline

How it works

The root property behind all three findings is that agent configuration can become executable behavior: Paperclip's built-in process adapter intentionally launches a configured command as a child process of the server. The vulnerabilities changed who could reach that launcher and whose configuration the server would trust.^[1]

For CVE-2026-41679, a newly registered board user could self-approve a CLI challenge to obtain a durable board API credential, then abuse the new-company import route which accepted board-level access rather than requiring instance-administrator rights. The imported .paperclip.yaml defined a process-adapter agent and command; importing also made the attacker a company member, so the wakeup check passed and the command executed with the server process's OS privileges.^[1]

For GHSA-x8hx-rhr2-9rf7, default local_trusted mode bound to loopback and treated every reaching request as an implicit instance administrator, equating network location with identity. A DNS-rebinding attack made an attacker hostname resolve to both the attacker's server and 127.0.0.1; the browser treated later requests as same-origin and Paperclip accepted the attacker hostname in the Host header, allowing import and wakeup calls to run a command with the developer's privileges. The proof of concept was verified on macOS with Firefox.^[1]

For GHSA-xfqj-r5qw-8g4j, unauthenticated requests continued through middleware with a 'no actor' identity, leaving each route to enforce its own assertion. A caller with a valid heartbeat-run identifier could retrieve associated issue data without proving company access, and other routes exposed skill documentation and health details; the unauthenticated CLI challenge route also fed the CVE-2026-41679 credential chain.^[1]

Fixes in v2026.416.0 require instance-administrator access for new-company imports and company access for existing-company imports (covering both preview and execution), enable a private-hostname guard that runs before identity-assigning middleware to reject rebound requests with unapproved hostnames, and add authentication and company-access checks to previously exposed routes.^[1]

Affected versions and patch status

Key takeaways

• Agent configuration must be treated as executable input: in agentic platforms, a configuration import that reaches a process launcher is equivalent to remote code execution, so import and activation paths need the same authorization as direct code execution.^[1]
• Trusting a credential, a route, or a network location without enforcing the check the later operation requires produced all three failures — self-approved credentials, missing route checks, and trusted-localhost assumptions defeated by DNS rebinding.^[1]
• Despite a public Metasploit module and proof-of-concept classification, no in-the-wild exploitation was reported as of August 5, 2026, and inconsistent version labeling (v2026.416.0 versus 0.3.1) plus a patchless DNS-rebinding advisory make v2026.416.0-or-later the safest upgrade reference for operators.^[1][2]

Defensive actions

• Upgrade Paperclip to v2026.416.0 or later.: The code tagged v2026.416.0 contains the import-authorization fix and the private-hostname guard; Paperclip's release notes tell all deployments to upgrade and Oasis recommends v2026.416.0 or later. Because advisory and NVD metadata are inconsistent, this tag is the safest upgrade point.^[1]
• Review how registration and deployment exposure are configured.: The server-side RCE depends on the default open-signup registration configuration on network-accessible authenticated instances, so restricting exposure and registration reduces the reachable attack surface.^[1]
• Prioritize remediation given the mature exploitation tooling.: Rapid7 published a Metasploit module automating the six-request CVE-2026-41679 chain and CISA's SSVC enrichment rates the flaw automatable with total technical impact and proof-of-concept exploitation; absence from KEV does not rule out exploitation.^[1][2]