Open-source AI company Paperclip plays a significant role in orchestrating autonomous AI agents at scale, enabling organizations to centrally manage a company of AI agents. A design choice causes Paperclip to treat agent configuration as trusted data, implicitly assuming that configuration data is controlled by an authenticated and authorized user, although this is by no means guaranteed. This choice sets up three separate vulnerabilities recently discovered by researchers at Oasis Security.
Registration to Root Access in Minutes
The first flaw, tracked as CVE-2026-41679, begins with the fact that Paperclip allows open registration without email verification, offering an easy entry point. After registration, an attacker can self-approve their own CLI challenge, granting them board-level API access. The threat actor can then take advantage of the lower authorization bar on the import path to import a malicious agent that launches attacker commands as the services account.
This vulnerability can enable an attacker to carry out full remote code execution on Paperclip instances without requiring any authentication, user interaction, or credentials. Many Paperclip instances are network accessible and running in “authenticated” mode under default configurations, leaving them open for threat actors to launch a fully automated attack exploiting this flaw.
Opt-In Authorization Checks
The second issue, GHSA-xfqj-r5qw-8g4j, works because of unauthenticated routes leaking cross-tenant workflow and skill data. Sensitive API endpoints leave out crucial authentications and checks, including heartbeat issue retrieval, agent skill documentation, and information about deployment health. This leaves significant metadata exposed to unauthenticated callers, lowering the barrier for exploitation and sharpening the attack chain of CVE-2026-41679. An attacker can access sensitive information without authentication, allowing extensive reconnaissance in advance of further malicious activity.
Assumed Trust in Loopback Traffic
The third vulnerability, GHSA-x8hx-rhr2-9rf7, happens because the local-development mode makes the assumption that all loopback traffic reaching the address Paperclip is bound to is implicitly safe. Attackers can use JavaScript on controlled pages to exploit DNS rebinding and redirect a browser session to the address (127.0.0.1). This enables drive-by execution on a developer’s machine without the need for any interaction by the target beyond a single page visit. Rather than impacting network-accessible Paperclip instances, this vulnerability directly affects developers running Paperclip locally with default configurations.
A Pattern, Not an Anomaly
These flaws are not isolated issues, but part of a widespread pattern of vulnerabilities, as independent researchers cite the same flaw across other agent platforms. Keeping dangerous default network permissions without assessing and reconfiguring is an industry-wide habit that introduces significant risk. The understanding of configuration as code blurs the line that agent platforms were built to enforce, creating an environment where access to sensitive information and controls is not gated effectively.
Experts stress that this is a broad issue that any company using agentic AI should be concerned with. “This is the core challenge organizations must confront as AI agents become foundational to how work gets done,” says Darren Guccione, CEO and Co-Founder at Keeper Security, a Chicago-based provider of zero-trust and zero-knowledge cybersecurity software. “Agents authenticate to external systems, invoke tools and make changes across code, cloud and SaaS environments – and they do it autonomously, acting under delegated authority with no human checkpoint between intent and execution.”
What Changes Now for Security Leaders
The next steps after the disclosure of these flaws include immediate mitigation as well as long-term and systemic security improvements. In response to the disclosure, Paperclip has patched authorization checks and hostname validation in version 2026.416.0; upgrading Paperclip to this version or later is the first step in remediating the risk. It is also recommended that agent adapters and command fields are treated as privileged executable code to protect against exposure to bad actors. Agent platforms should look to this as a warning sign that they owe their enterprise customers a shift in how they handle governance to avoid issues like this in the future.
