Critical vulnerability in Paperclip, a Node.js server and React UI that orchestrates AI agents for business operations. Prior to version 2026.416.0, unauthenticated attackers can achieve full remote code execution on network-accessible instances running in authenticated mode with default configuration. The attack requires no user interaction or credentials, only the target's address. The exploit chain consists of six automated API calls that work against default deployment configurations. Version 2026.416.0 patches this critical security issue.