Critical Paperclip Vulnerabilities Allow Attackers to Gain Admin Access

Critical vulnerabilities have been disclosed in Paperclip, an AI agent orchestration platform, that could allow attackers to gain administrative access and execute commands on affected servers.

The most severe flaw, tracked as CVE-2026-41679, carries a CVSS score of 10.0 and affects network-accessible Paperclip deployments using the default authenticated configuration.

Paperclip helps organizations operate autonomous AI agents through companies, tasks, adapters, and configurable workflows. A key feature allows users to import company bundles containing .paperclip.yaml files.

These files can define agents, their execution adapters, and commands they run. This turns an apparently simple configuration import into a high-risk execution path.

The critical vulnerability stemmed from an authorization mismatch. Paperclip required instance-administrator permissions to create a company directly.

However, its import route allowed a user with lower board-level access to import a new company. An attacker could exploit the difference to create a company containing a malicious agent configuration.

Paperclip Vulnerabilities

The attack chain began with open registration. A remote attacker could register an account without email verification, sign in, create a CLI authorization challenge, and approve that challenge using the same account.

This process activated a persistent board API token, effectively granting the attacker elevated API access without an independent approval step. Using this token, the attacker could access the company import route and upload a crafted bundle.

The malicious .paperclip.yaml file could configure an agent to use Paperclip’s built-in process adapter, which launches commands as child processes on the host server.

After importing the company, an attacker could wake the agent, causing Paperclip to execute the chosen command. According to the Oasis report, successful exploitation would grant the attacker the permissions of the operating system account running Paperclip.

Depending on the deployment, this could expose application data, source code repositories, local credentials, secrets available to agent processes, and internal services reachable from the host.

Two additional flaws expanded the risk. The first involved API endpoints that did not consistently enforce authentication or company-level authorization.

These exposed heartbeat issue data, agent skill documentation, and health information that could reveal deployment details, feature flags, authentication readiness, and the installed version.

The second critical issue affected Paperclip’s local_trusted mode. In this mode, the service binds to 127.0.0.1 and assumes incoming requests originate from trusted local software.

Researchers found that a DNS rebinding attack could break this assumption. An attacker-controlled website could use browser-based requests to reach the local Paperclip API and have them treated as administrator actions.

The attacker could then import and activate a malicious agent, resulting in command execution on the developer’s machine.

Paperclip addressed the flaws by requiring stronger authorization for new company imports, tightening company-scoping checks, protecting previously exposed API routes, and adding hostname validation in locally trusted deployments.

Organizations should upgrade immediately, restrict public registration where unnecessary, review imported agent configurations, and treat agent adapters and command fields as privileged executable code.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.

The post Critical Paperclip Vulnerabilities Allow Attackers to Gain Admin Access appeared first on Cyber Security News.