Full Report
Two security flaws in Paperclip could let attackers execute commands on a network server or a developer's computer. Paperclip is an open-source control plane for teams of artificial intelligence (AI) agents, and both paths rely on importing a malicious agent and starting it. A third flaw could expose sensitive data and control-plane details through application programming interface (API) routes
Analysis Summary
# Vulnerability: Critical Command Execution in Paperclip AI
## CVE Details
- **CVE ID:** CVE-2026-41679 / GHSA-x8hx-rhr2-9rf7
- **CVSS Score:** 10.0 (Critical) / 9.6 (Critical)
- **CWE:** Improper Access Control / Improper Input Validation (Agent configuration treated as executable)
## Affected Systems
- **Products:** Paperclip (Open-source AI agent control plane)
- **Versions:** Versions prior to v2026.416.0
- **Configurations:**
- **CVE-2026-41679:** Network-accessible deployments using "authenticated mode" with default open-registration enabled.
- **GHSA-x8hx-rhr2-9rf7:** Local deployments running in the default `local_trusted` mode.
## Vulnerability Description
Paperclip features a built-in process adapter that allows AI agents to launch commands as child processes of the server. The vulnerabilities arise from how the system authorizes these configurations:
1. **Server-Side Chain:** An attacker can exploit the default open-signup flow to register an account, self-approve a CLI challenge to gain API credentials, and use a "new-company import" route that fails to verify administrative privileges. By importing a malicious `.paperclip.yaml` bundle, the attacker can define and execute arbitrary shell commands with the privileges of the Paperclip server process.
2. **Localhost Chain:** Relies on DNS-rebinding or browser-originated requests to interact with a Paperclip instance running in `local_trusted` mode, allowing a malicious webpage to inject and trigger executable agent configurations.
## Exploitation
- **Status:** PoC available (Public Metasploit module released by Rapid7). No confirmed "in-the-wild" exploitation reported as of August 5, 2026.
- **Complexity:** Low (CVE-2026-41679 requires no pre-existing account or victim interaction).
- **Attack Vector:** Network / Local (Depending on the specific CVE).
## Impact
- **Confidentiality:** High (Access to application data, source code, stored credentials, and secrets).
- **Integrity:** High (Ability to execute arbitrary commands on the host server).
- **Availability:** High (Potential for full system takeover or service disruption).
## Remediation
### Patches
- **Version v2026.416.0:** Contains the primary fix for the import-authorization flaw and hostname-validation guards.
### Workarounds
- Disable open registration/signup flows if not strictly required.
- Restrict network access to the Paperclip control plane using firewalls or VPNs.
- Avoid running the application in `local_trusted` mode when browsing untrusted websites.
- Ensure the server process runs with the least privilege necessary to mitigate the impact of command execution.
## Detection
- **Indicators of Compromise:**
- Unexpected new company creations or agent imports in server logs.
- Unauthorized CLI challenge approvals from newly registered accounts.
- Suspicious child processes originating from the Paperclip server execution adapter.
- **Detection methods:** Monitor for the use of the Metasploit module targeting CVE-2026-41679.
## References
- Vendor Advisory: [https://github.com/paperclipai/paperclip/security/advisories/GHSA-68qg-g8mg-6pr7]
- Technical Analysis: [https://www.oasis.security/blog/paperclip-agent-vulnerabilities]
- Metasploit Module: [https://docs.rapid7.com/insightvm/cve-2026-41679] (Defanged link structure: hxxps[://]docs[.]rapid7[.]com)