Paperclip Flaws Enable Remote Command Execution

According to the GitHub Security Advisory for @paperclipai/server, an unauthenticated attacker could chain multiple API calls to achieve remote code execution against a network-accessible instance in authenticated mode. The advisory identifies affected versions as releases before 2026.410.0 and describes a six-call attack chain.

The reported sequence begins with self-registration. The GitHub advisory states that sign-up was enabled by default, did not require an invite token, and did not require email verification. It then describes an unauthenticated CLI authorization-challenge endpoint through which a newly created user could approve their own challenge and obtain a board-level API token.

Infosecurity Magazine reports that this token could reach a company import route whose authorization check required board-level access rather than instance-administrator access. An attacker could then import an agent bundle configured to use the process adapter, and starting that agent would execute the specified command with the server process's operating-system privileges, according to the publication.

The Hacker News reports that Rapid7 released a public Metasploit module for CVE-2026-41679 and that NVD's CISA Stakeholder-Specific Vulnerability Categorization enrichment classified exploitation as proof-of-concept. The publication reported no authoritative evidence of exploitation in the wild as of August 5.

Two additional flaws affect different parts of Paperclip's deployment model. GitHub advisory GHSA-xfqj-r5qw-8g4j, rated CVSS 8.3, describes access-control failures in routes that exposed heartbeat data, agent documentation and health information without the expected checks.

A separate July 22 advisory, GHSA-x8hx-rhr2-9rf7, is rated CVSS 9.6 and affects Paperclip's default local_trusted mode. The advisory and The Hacker News report that an attacker could exploit a DNS-rebinding path if a user opened an attacker-controlled page while a local Paperclip instance was running. That route could also lead to attacker-controlled agent configuration reaching the host execution adapter.

CSO Online reports that the three issues stemmed from identity and authorization assumptions across Paperclip's authenticated and local deployment modes. The article describes the broader risk: control of an agent configuration can direct privileged actions across systems accessible to that agent.

Public sources cite different version markers for the fixes. The GitHub Advisory Database lists 2026.410.0 as the patched version for the import-authorization RCE advisory. The Hacker News reports that the Paperclip source tagged v2026.416.0 contains the import-authorization and hostname-validation fixes, while CSO Online reports fixes shipped in versions 2026.416.0 and 0.3.1. Operators should verify the applicable Paperclip release line and advisory status rather than treating a single version number as coverage for all three findings.

For AI platform teams, the disclosures illustrate a recurring security property of agent control planes: configuration is not merely metadata when it can select tools, invoke adapters or launch host processes. Comparable systems require authorization boundaries around registration, token issuance, imports, configuration changes and execution triggers, alongside deployment controls that distinguish localhost assumptions from network-exposed services.