Critical Vulnerabilities in Paperclip AI Platform Allow Remote Code Execution

Critical Flaws Discovered in Paperclip AI Platform

Two critical security vulnerabilities have been identified in Paperclip, an open-source control plane designed for managing teams of artificial intelligence agents. These flaws could enable attackers to execute arbitrary commands on network servers or developer computers by importing malicious agents.

A third vulnerability was also found, which exposed sensitive data and control-plane details through Application Programming Interface (API) routes that lacked proper access checks.

Remote Code Execution Vulnerabilities

The most severe vulnerability, tracked as CVE-2026-41679, carries a CVSS score of 10.0. This flaw allows remote attackers to achieve arbitrary code execution with server permissions on network-accessible Paperclip instances configured in authenticated mode with default registration settings. Exploitation requires no pre-existing account or victim interaction.

A second path, tracked as GHSA-x8hx-rhr2-9rf7 with a CVSS score of 9.6, allows code execution on a developer's computer. This requires a user to open an attacker-controlled page while Paperclip is running in its default local_trusted mode.

Authorization Bypass and Exploitation

CVE-2026-41679 is an authorization bypass that allows remote attackers to self-register an account without email verification. Once an account is created, an attacker can sign in, create and approve a Command Line Interface (CLI) challenge, and then deploy an agent by importing a new company via crafted YAML files. This process grants board-level API access and enables arbitrary code execution.

Rapid7 has released a public Metasploit module for CVE-2026-41679, indicating the ease of exploitation for this critical vulnerability.

Patched Version and Impact

Paperclip version v2026.416.0 includes fixes for the import-authorization and hostname-validation issues. However, a patched version for the DNS-rebinding advisory was not specified.

These vulnerabilities highlight the importance of treating agent configuration as executable input and securing AI agent platforms, as they can pose significant risks to organizations operating autonomous AI agents at scale.