Paperclip AI Flaws Let Attackers Run Host Commands via Malicious Agent Imports

Three security vulnerabilities were discovered in Paperclip, an open-source control plane for AI agent teams. CVE-2026-41679 (CVSS 10.0): An unauthenticated attacker can exploit Paperclip's default open-signup flow to register an account, self-approve a CLI challenge to obtain a board-level API credential, then use that credential to import a malicious .paperclip.yaml bundle via the new-company import route (which incorrectly accepted board-level access instead of requiring instance-administrator rights). The bundle defines a new company with an agent using the process adapter and an attacker-specified command. After import, the attacker is automatically a company member, allowing them to trigger the agent wakeup and execute OS-level commands with the server process's privileges. Rapid7 published a Metasploit module automating the six-request attack chain. GHSA-x8hx-rhr2-9rf7 (CVSS 9.6): A DNS rebinding attack targeting Paperclip running in default local_trusted mode. An attacker-controlled hostname resolves to both the attacker's server and 127.0.0.1. The browser loads JavaScript from the attacker's server; after DNS rebinding, subsequent requests reach the local Paperclip instance. Because local_trusted mode treats all loopback requests as implicit instance administrators and accepted the attacker's hostname in the Host header, the attacker can call the import API, install a malicious agent, and execute commands with the developer's OS privileges. No Paperclip credentials are required. Verified on macOS with Firefox. GHSA-xfqj-r5qw-8g4j (CVSS 8.3): Multiple API routes in authenticated mode failed to enforce access controls. Issues include: retrieval of heartbeat-run issue data without company access verification, unauthenticated access to agent-facing skill documentation (API paths and auth conventions), unauthenticated access to health/deployment information (mode, version, auth readiness, bootstrap state, feature flags), and an unauthenticated CLI challenge route that formed part of the CVE-2026-41679 exploit chain. The root cause was that unauthenticated requests passed through middleware with a 'no actor' identity, leaving each route responsible for its own authorization checks, which were inconsistently applied. Paperclip's built-in process adapter intentionally launches configured commands as child processes of the server, meaning agent configuration becomes directly executable behavior.