Paperclip AI Flaws Let Attackers Run Host Commands
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Paperclip's process adapter is a legitimate feature that intentionally launches configured commands as child processes; Oasis Security framed the three flaws through one property: agent configuration can become executable behavior — the bugs changed who could reach the launcher.
- CVE-2026-41679 (CVSS 10.0) targets network-accessible authenticated deployments with default open registration, letting an unregistered user self-approve a CLI credential, import a .paperclip.yaml bundle defining a company with a process-based agent, and trigger host command execution under the server's OS privileges.
- GHSA-x8hx-rhr2-9rf7 (CVSS 9.6) is a DNS-rebinding path against Paperclip's default local_trusted mode, where an attacker-controlled hostname resolves to both the attacker's server and 127.0.0.1, letting a browser page call the import API and run commands with the developer's privileges; the proof of concept was verified on macOS with Firefox.
- GHSA-xfqj-r5qw-8g4j (CVSS 8.3) covers API routes in authenticated mode that failed to enforce access checks, exposing heartbeat-run issue data, agent-facing skill documentation with API paths, and deployment health metadata to unauthenticated callers.
- Rapid7 published a Metasploit module in June 2026 automating the six-request CVE-2026-41679 chain; CISA-ADP enrichment carried by NVD classifies the flaw as automatable with proof-of-concept exploitation, though no in-the-wild exploitation was reported as of August 5, 2026 and the flaw is absent from CISA's Known Exploited Vulnerabilities catalog.
- Paperclip's v2026.416.0 fix requires instance-administrator access for new-company imports and enables a private-hostname guard for local_trusted and authenticated private deployments, though the DNS-rebinding advisory still lacks a patched-version entry while NVD retains older affected-version metadata — the safest upgrade target is v2026.416.0 or later regardless.
Why it matters: Operators running Paperclip on network-accessible infrastructure with the default open-signup flow face automated exploitation of CVE-2026-41679 via a public Metasploit module, and the affected-version metadata in NVD still trails the actual fix in v2026.416.0. The DNS-rebinding advisory also lacks a patched-version entry, so local_trusted deployments remain a blind spot without manual version checking.
