Three critical vulnerabilities in the open-source AI agent platform Paperclip could be linked together to enable remote code execution, data exposure, and compromise of developer machines, according to research from Oasis Security shared Wednesday. The flaws all originated from the same fundamental problem: Paperclip made assumptions about trust and identity that attackers could exploit. All three issues have been patched in versions 2026.416.0 and 0.3.1.
The most serious flaw, tracked as CVE-2026-41679, affected authenticated deployments running Paperclip's default registration configuration. An attacker could start as an unauthenticated user, create their own account through self-registration, approve their own command-line authorization request, and gain persistent board-level API access—all without needing separate approval from an administrator. With board-level permissions secured, an attacker could then exploit a second authorization mismatch in the platform's company import workflow. While directly creating a new company required instance administrator privileges, importing one only enforced board-level permissions. Since imported company bundles could contain executable agent definitions, an attacker could upload a malicious ".paperclip.yaml" file that specified a process-based agent, then activate that agent to run arbitrary operating system commands with the Paperclip server's privileges. Beyond the critical remote code execution chain, Oasis uncovered two additional vulnerabilities highlighting similar architectural weaknesses. Several API endpoints either lacked authentication entirely or didn't enforce tenant-level authorization, exposing workflow data, skill documentation, and deployment metadata useful for attacker reconnaissance or cross-tenant information disclosure. A third issue, rated CVSS 9.6, affected Paperclip's default "local_trusted" deployment mode, where the platform assumed any requests reaching localhost came from trusted software. Oasis showed that a DNS rebinding attack could break that assumption, letting an attacker-controlled webpage communicate with the local Paperclip service and ultimately run commands on a developer's machine after importing and triggering a malicious agent.
"The Paperclip vulnerabilities Oasis Security has disclosed expose something more consequential than a single open-source project: a systemic failure in how AI agent control planes handle identity boundaries," said Darren Guccione, CEO and co-founder of Keeper Security, who reviewed the research. According to Oasis researchers, AI agent configuration should be treated as executable input rather than simple data. Guccione noted that an attacker who gains control of an agent configuration doesn't just access data—they gain the ability to direct privileged action across every system that agent can reach.
Paperclip addressed the remote code execution path and the leaking API issues in version 2026.416.0 by requiring administrator privileges for new-company imports, strengthening authorization checks across related operations, and adding regression tests. The third vulnerability was fixed in Paperclip 0.3.1 by enabling hostname validation, hardening imports, and restricting risky adapters in agent-safe imports. Guccione argued that traditional access controls don't work well for autonomous agents. "The security question is no longer whether a credential is valid at the point of entry," he said. "It's whether the agent invoking that credential is doing so within the intended scope, for the intended purpose, under the authority of a human who would sanction that action." Organizations running AI agents will need to rethink how they architect identity and authorization boundaries around autonomous systems that can act across multiple environments. The shift from protecting static credentials to governing dynamic agent behavior represents a fundamental change in how security teams must approach access control in AI-driven infrastructure.