Paperclip AI Flaws Expose Servers to RCE via Malicious Agent Imports

Two critical security vulnerabilities in Paperclip, an open-source control plane for managing teams of AI agents, could allow attackers to execute arbitrary host commands on a network server or a developer's machine. Both exploitation paths rely on importing a malicious agent and starting it, effectively turning legitimate agent configuration into executable behavior. According to a 17-page technical report from Oasis Security, the flaws fundamentally changed who could reach Paperclip's built-in process adapter and whose configuration the server would trust.

The most severe issue, tracked as CVE-2026-41679 with a maximum CVSS score of 10.0, targets internet-accessible deployments running in authenticated mode with the default open registration configuration. An attacker can register without an invitation or verified email, create a pending CLI challenge, and approve it themselves, activating a durable board API credential without administrator involvement. From there, the attacker imports a malicious agent whose configuration reaches the host execution adapter, triggering command execution on the server. The second flaw, GHSA-x8hx-rhr2-9rf7 (CVSS 9.6), exploits a DNS-rebinding weakness against Paperclip's default local_trusted mode, requiring only that a user visit an attacker-controlled page. A third weakness exposes sensitive control-plane data through API routes missing proper access checks. Rapid7 has already shipped a public Metasploit module for CVE-2026-41679, and CISA's SSVC enrichment via NVD currently classifies exploitation as proof-of-concept, with no confirmed in-the-wild attacks reported as of August 5, 2026.

Oasis Security distilled the core lesson simply: "Agent configuration must be treated as executable input." Operators should immediately update to Paperclip v2026.416.0 or later, which contains the import-authorization fix and hostname-validation guard. Administrators running exposed deployments should audit their registration settings and confirm network exposure, using a port scanner to verify whether management interfaces are reachable from the public internet. For local instances, reviewing browser behavior and network segmentation helps mitigate the DNS-rebinding variant, while checking credential hygiene with a password checker and confirming session integrity through a DNS leak test can harden the surrounding environment against similar trust-boundary failures in AI orchestration tooling.