Overview
Two critical vulnerabilities in Paperclip — an open-source control plane for AI agent teams — allow attackers to execute arbitrary commands on the host server or a developer’s local machine by importing a maliciously crafted agent configuration. Discovered and documented by Oasis Security in a 17-page technical report, the flaws expose a fundamental design tension in agentic AI platforms: the same mechanism that makes agent behaviour configurable also makes configuration a vector for code execution. A third vulnerability exposes sensitive internal data through API routes that bypass expected access controls.
Technical Analysis
Paperclip’s built-in process adapter is a legitimate feature — it launches a configured command as a child process of the server. Both attack paths abuse this adapter by introducing attacker-controlled agent configuration that the server proceeds to execute.
Server-Side Path (CVE-2026-41679, CVSS 10.0): Targets internet-accessible deployments running in authenticated mode with the default open-registration configuration. An attacker registers without invitation or email verification, signs in, and initiates the CLI authorisation challenge flow. Critically, the same user can create and approve their own pending CLI challenge, generating a durable board API credential without administrator involvement. That credential — which should not have been sufficient — can then be used to create a top-level company entity and import a malicious agent, ultimately triggering host command execution. No victim interaction is required.
DNS Rebinding Path (GHSA-x8hx-rhr2-9rf7, CVSS 9.6): Targets developers running Paperclip locally in its default local_trusted mode. An attacker tricks the victim into visiting a malicious web page; via DNS rebinding, the attacker’s origin is treated as trusted localhost, enabling browser-originated requests to import and activate a malicious agent configuration. This reaches the same process adapter and achieves equivalent code execution on the developer’s machine.
Data Exposure Flaw: A third issue allows unauthenticated or under-privileged users to access sensitive API routes that were expected to enforce access checks, potentially leaking control-plane metadata and credentials.
Rapid7 has published a public Metasploit module for CVE-2026-41679. CISA’s SSVC classification on NVD marks exploitation status as proof-of-concept. No confirmed in-the-wild exploitation was reported as of publication.
Framework Mapping
These vulnerabilities map most directly to LLM08 (Excessive Agency) — the process adapter grants agents the ability to execute host commands, and the vulnerability chain removes the access controls gatekeeping that capability. LLM07 (Insecure Plugin Design) applies to the adapter’s lack of input trust boundaries. LLM06 (Sensitive Information Disclosure) covers the API access control bypass. From an ATLAS perspective, AML.T0047 (ML-Enabled Product or Service) and AML.T0012 (Valid Accounts) are relevant to the server-side registration abuse chain.
Impact Assessment
Any organisation running a Paperclip deployment accessible over a network with default registration enabled faces critical, unauthenticated RCE risk. Developers running local instances are exposed to the DNS rebinding path whenever they browse the web while Paperclip is active. The public Metasploit module substantially lowers the barrier to exploitation for opportunistic attackers.
Mitigation & Recommendations
- Upgrade immediately to Paperclip v2026.416.0 or later, which includes the import-authorisation fix and hostname-validation guard.
- Disable open registration on all internet-facing deployments or restrict it to invitation-only flows.
- Audit API route access controls to identify and remediate any unenforced authorisation checks.
- Treat agent configuration as executable input — apply the same trust controls to configuration payloads as to direct code execution.
- Monitor for unexpected CLI credential creation or company-entity provisioning events in audit logs.
References
- The Hacker News — Original Article
- Oasis Security Technical Report (17 pages, linked in original article)
- NVD Entry: CVE-2026-41679