Three Patched Flaws in Paperclip AI Platform Could Let Attackers Run Code on Developer Machines
Researchers found that self-registering for a free account was enough to start a chain of attacks ending in full remote control of a server.
Key points
- Security firm Oasis Security disclosed three vulnerabilities in Paperclip, an open-source platform for building AI agents, in May 2026.
- The most severe flaw, CVE-2026-41679, let any unauthenticated user sign up, approve their own access request, and reach administrator-level control without any human approving them.
- A separate flaw scored 9.6 out of 10 on the standard severity scale and allowed a malicious webpage to silently run commands on a developer's own laptop.
- All three vulnerabilities are now patched in Paperclip versions 2026.416.0 and 0.3.1.
- The root cause in every case was the same: Paperclip trusted that certain requests were safe without properly checking who was really making them.
Paperclip is an open-source platform that lets software developers build AI agents, meaning programs that can take actions on a computer on behalf of a user, such as running workflows, calling other tools, or managing data. Oasis Security, a research firm, found three separate security flaws in it and shared their findings with CSO Online ahead of publishing them this week.
Taken together, the flaws paint a picture of a platform that assumed too much about who it was talking to.
How did the attacks actually work?
The worst flaw let a complete stranger on the internet take over a Paperclip server in a few steps. An attacker could simply create a free account on a Paperclip instance that had open registration turned on (its default setting). Once registered, the attacker could approve their own CLI request. A CLI, or command-line interface, is a text-based tool developers use to control software directly. Approving their own request handed them "board-level" access, meaning the highest tier of permission a regular user could hold.
That access was enough to trigger a second flaw. Paperclip's "company import" feature, designed to let administrators load pre-packaged configurations, only checked for board-level permission rather than the stricter administrator permission it should have required. An attacker could package a malicious ".paperclip.yaml" file inside one of those bundles. A YAML file is a simple text file used to store configuration settings, but Paperclip would execute the instructions inside it. The result: arbitrary commands running directly on the Paperclip server, under the server's own privileges.
Oasis researchers tracked this chain as CVE-2026-41679, giving it the maximum possible severity rating.
What were the other two flaws?
The second issue involved API endpoints that lacked proper access controls. An API, or application programming interface, is the set of digital "doors" a service opens so other software can talk to it. Several of Paperclip's doors were either unlocked entirely or failed to check whether the person knocking belonged to the right account. Attackers could peek at workflow details, documentation, and configuration metadata from other users' accounts, information useful for planning further attacks.
The third flaw, rated 9.6 out of 10 for severity, targeted developers running Paperclip locally on their own computers. Paperclip's "local trusted" mode assumed that any request arriving from the machine's own network address could be trusted. A DNS rebinding attack, where a malicious website tricks a browser into thinking it is a trusted local service, could shatter that assumption. A developer who simply visited the wrong webpage while Paperclip was running locally could have commands executed on their machine without clicking anything.
| Flaw | Severity | What it allowed | Fixed in |
|---|---|---|---|
| CVE-2026-41679 (auth bypass + RCE) | Critical (max) | Self-register, escalate, execute server commands | 2026.416.0 |
| Unauthenticated API endpoints | High | Read other users' workflow and config data | 2026.416.0 |
| DNS rebinding on localhost | 9.6/10 | Run commands on a developer's local machine | 0.3.1 |
Should developers running Paperclip be worried?
Not if they update immediately. Paperclip shipped fixes in versions 2026.416.0 and 0.3.1, addressing all three issues by requiring administrator-level permission for company imports, tightening authorization checks, and adding hostname validation to stop DNS rebinding attacks.
If you run Paperclip and have not updated, do so now. Check your logs for unexpected account registrations or company import events. Darren Guccione, CEO of Keeper Security, who reviewed the Oasis research, put the wider point plainly: "The security question is no longer whether a credential is valid at the point of entry. It's whether the agent invoking that credential is doing so within the intended scope, for the intended purpose, under the authority of a human who would sanction that action."
AI agents do not just read data. They act. That makes the files that configure them as dangerous as executable code.
