Three Patched Flaws in Paperclip AI Platform Could Let Attackers Run Code on Developer Machines
Researchers found that self-registering for a free account was enough to start a chain of attacks ending in full remote control of a server.
Key points
- Security firm Oasis Security disclosed three vulnerabilities in Paperclip, an open-source platform for building AI agents, in May 2026.
- The most severe flaw, CVE-2026-41679, let any unauthenticated user sign up, approve their own access request, and reach administrator-level control without human approval.
- A separate flaw scored 9.6 out of 10 on the standard severity scale and allowed a malicious webpage to silently run commands on a developer's laptop.
- All three vulnerabilities are patched in Paperclip versions 2026.416.0 and 0.3.1.
- Every root cause was the same: Paperclip trusted that certain requests were safe without properly verifying who made them.
Paperclip is an open-source platform for building AI agents, programs that act on a computer on behalf of a user. Oasis Security found three separate flaws and shared their findings with CSO Online ahead of publication. Worth noting: we covered Oasis Security's acquisition by Cyera for $1 billion on 28 July, a deal built around exactly this problem of controlling what AI agents can see and do.
Taken together, the flaws show a platform that assumed too much about who it was talking to.
How did the attacks actually work?
The worst flaw let a stranger on the internet take over a Paperclip server in a few steps. An attacker could create a free account on a Paperclip instance with open registration, its default setting. Once registered, they could approve their own CLI request. A CLI, or command-line interface, is a text-based tool developers use to control software directly. That approval handed them board-level access, the highest permission tier available to a regular user.
That access was enough to trigger a second flaw. Paperclip's company import feature, designed to let administrators load pre-packaged configurations, checked only for board-level permission rather than the stricter administrator permission it should have required. An attacker could embed a malicious ".paperclip.yaml" file inside one of those bundles. A YAML file stores configuration settings as plain text, but Paperclip would execute the instructions inside it. The result: arbitrary commands running on the Paperclip server under its own privileges.
Oasis researchers tracked this chain as CVE-2026-41679, rated at maximum severity.
What were the other two flaws?
The second issue involved API endpoints, the digital interfaces a service opens so other software can communicate with it, that either lacked authentication entirely or failed to check whether a request belonged to the right account. Attackers could read workflow details and deployment metadata from other users' accounts, useful intelligence for planning further attacks.
The third flaw, rated 9.6 out of 10, targeted developers running Paperclip locally. Paperclip's "local trusted" mode assumed any request from the machine's own network address was safe. A DNS rebinding attack, where a malicious website tricks a browser into treating itself as a trusted local service, breaks that assumption. Visit the wrong page while Paperclip is running and commands execute on your machine without a click.
| Flaw | Severity | What it allowed | Fixed in |
|---|---|---|---|
| CVE-2026-41679 (auth bypass + RCE) | Critical (max) | Self-register, escalate, execute server commands | 2026.416.0 |
| Unauthenticated API endpoints | High | Read other users' workflow and config data | 2026.416.0 |
| DNS rebinding on localhost | 9.6/10 | Run commands on a developer's local machine | 0.3.1 |
Should developers running Paperclip be worried?
Not if they update immediately. Fixes in versions 2026.416.0 and 0.3.1 require administrator-level permission for company imports, tighten authorization checks, and add hostname validation to block DNS rebinding.
If you haven't updated, do it now. Check your logs for unexpected account registrations or company import events. Darren Guccione, CEO and co-founder of Keeper Security, who reviewed the Oasis research, told CSO Online: "The security question is no longer whether a credential is valid at the point of entry. It's whether the agent invoking that credential is doing so within the intended scope, for the intended purpose, under the authority of a human who would sanction that action."
The pattern here is familiar. Our RufRoot story from 29 July showed how a similar authentication failure in an AI platform could persist even after patching; Paperclip's fixes appear more surgical, but the underlying lesson is the same. AI agents act. That makes their configuration files as dangerous as executable code, and platforms that treat them otherwise will keep appearing in research like this.
