INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Paperclip AI Flaws Allow Unauthenticated Command Execution

| 2026-08-05 15:14 CRITICAL MEDIUM VULNERABILITY DISCLOSURE
JSON
Executive Summary
AI-generated
The incident data reveals a critical vulnerability in Paperclip, an agent-facing skill documentation system. The source tagged as Paperclip v2026.416.0 contains the import-authorization fix and hostname-validation guard discussed below, although the DNS-rebinding advisory does not identify a patched version. This means that attackers can exploit CVE-2026-41679 by creating a new company, using an agent with the process adapter, and running the command imported by the agent. The vulnerability requires instance-administrator access for imports targeting a new company and company access for imports targeting an existing one. Paperclip fixed this flaw in v2026.416.0 by requiring authentication to be enabled on both general skill routes and targeted sector API paths. This patch was published by Rapid7, who also released a Metasploit module for CVE-2026-41679 that automates the six-request attack chain. The documented proof of concept has been verified on macOS with Firefox, but other browsers and operating systems may not produce identical results due to differences in user agent strings.
Technical Mitigations AI-generated
* Implement robust access controls and authentication mechanisms to enforce expected access checks on API routes, especially for sensitive data exposure. * Regularly update Paperclip to the latest version (e.g., v2026.416.0) or later to ensure that known vulnerabilities are patched. * Configure agent configuration as executable input by setting up a secure process adapter with proper permissions and validation mechanisms. * Use secure registration processes, such as invitation-based sign-up, to prevent unauthorized access to network-accessible deployments. * Implement API rate limiting and IP blocking to restrict unauthenticated command execution on servers and developers' machines.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 1 IoCs Create Free Account
pa•••••.yaml
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
CVE-2026-41679CVE-2026-41679
Target & Sectors
Global Scope
Incident Timeline
‎June 2026
Rapid7 published a Metasploit module in June 2026 that automates the CVE-2026-41679 attack chain.
vulnerability CVE-2026-41679
Rapid7 published a Metasploit module in June 2026 that automates the six-request CVE-2026-41679 attack chain.
malware Metasploit
Rapid7 published a Metasploit module in June 2026 that automates the six-request CVE-2026-41679 attack chain.
organisation CVE-2026
Rapid7 published a Metasploit module in June 2026 that automates the six-request CVE-2026-41679 attack chain.
‎August 4
Paperclip AI flaws allow attackers to run host commands via malicious agent imports.
organisation Oasis Security
According to new research by Oasis Security published on August 4, the flaws affect Paperclip, a control plane its developers describe as a platform for operating zero-human companies.
‎August 5, 2026
The attackers exploited a vulnerability in Paperclip's default open-signup flow to gain unauthorized access.
organisation The Hacker News
No authoritative source reviewed by The Hacker News reported exploitation in the wild as of August 5, 2026.
attribution Known Exploited
The vulnerability was not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog when The Hacker News checked it on August 5, 2026.
tactic T1588.006 - Vulnerabilities
The vulnerability was not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog when The Hacker News checked it on August 5, 2026.
attribution KEV
The vulnerability was not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog when The Hacker News checked it on August 5, 2026.
Absence from KEV does not rule out exploitation.
organisation CVE-2026-41679
Paperclip fixed CVE-2026-41679 in v2026.416.0 by requiring instance-administrator access for imports targeting a new company and company access for imports targeting an existing one.
infrastructure 416.0
Paperclip fixed CVE-2026-41679 in v2026.416.0 by requiring instance-administrator access for imports targeting a new company and company access for imports targeting an existing one.
Operators should update to v2026.416.0 or later and review how registration and deployment exposure are configured.
The GitHub security release is v2026.416.0, while the server and CLI manifests inside that tag report version 0.3.1.
The code tagged as v2026.416.0 contains the relevant fixes, while the DNS-rebinding advisory still lacks a patched-version entry and NVD retains older affected-version metadata in its history.
Paperclip's release notes tell all deployments to upgrade, and Oasis recommends v2026.416.0 or later.
infrastructure 0.3.1
The GitHub security release is v2026.416.0, while the server and CLI manifests inside that tag report version 0.3.1.
organisation NVD
The code tagged as v2026.416.0 contains the relevant fixes, while the DNS-rebinding advisory still lacks a patched-version entry and NVD retains older affected-version metadata in its history.
infrastructure Macos
The documented proof of concept was verified on macOS with Firefox, so the public record does not establish the same end-to-end result across every browser and operating system.
organisation Oasis Security's
Oasis Security's analysis , backed by a 17-page technical report , connects the findings through one product property: agent configuration can become executable behavior.
organisation A Board Key Approved
A Board Key Approved by Its Owner The attack against an internet-accessible instance begins with Paperclip's default open-signup flow.
organisation CLI
The same newly registered user could create a pending CLI challenge and approve it, activating a durable board API credential without a separate administrator making the decision.
organisation Domain Name System
Oasis demonstrated a Domain Name System (DNS) rebinding attack in which an attacker-controlled hostname resolved to both the attacker's server and 127.0.0.1.
organisation Host
The browser still considered the requests same-origin, and Paperclip accepted the attacker's hostname in the Host header.
organisation Routes Left Without Their Guards
Routes Left Without Their Guards The third advisory, GHSA-xfqj-r5qw-8g4j (CVSS score: 8.3), covers several API routes in authenticated mode that did not consistently reject unauthenticated or cross-company requests.
organisation GHSA-xfqj-r5qw-8g4j (
Routes Left Without Their Guards The third advisory, GHSA-xfqj-r5qw-8g4j (CVSS score: 8.3), covers several API routes in authenticated mode that did not consistently reject unauthenticated or cross-company requests.
‎2026.416.0
The attackers exploited a vulnerability in the Paperclip AI, which allowed them to run host commands via malicious agent imports.
‎2026/08/05
The attackers exploited a flaw in Paperclip AI's import-authorization and hostname-validation guards to gain access to sensitive data, including heartbeat information.
organisation GHSA-xfqj-r5qw-8g4j
A second finding, GHSA-xfqj-r5qw-8g4j (CVSS 8.3), covered several routes that omitted access checks entirely, exposing heartbeat data, agent documentation and health information.
infrastructure 416.0
The source tagged as Paperclip v2026.416.0 contains the import-authorization fix and hostname-validation guard discussed below, although the DNS-rebinding advisory does not identify a patched version.
organisation DNS
The source tagged as Paperclip v2026.416.0 contains the import-authorization fix and hostname-validation guard discussed below, although the DNS-rebinding advisory does not identify a patched version.
DNS rebinding let an attacker-controlled webpage cross that boundary.
organisation API
A third flaw could expose sensitive data and control-plane details through application programming interface (API) routes that did not enforce the expected access checks.
Paperclip allowed self-registration without email verification, and its CLI authorization flow let a new user approve their own credential challenge, turning that account into a persistent board-level API key with no separate approver.
organisation CLI
Paperclip allowed self-registration without email verification, and its CLI authorization flow let a new user approve their own credential challenge, turning that account into a persistent board-level API key with no separate approver.
organisation GHSA-x8hx-rhr2-9rf7
The second path, tracked as GHSA-x8hx-rhr2-9rf7 (CVSS score: 9.6), requires a user to open an attacker-controlled page while Paperclip is running in its default local_trusted mode.
organisation CVSS
Three vulnerabilities in an open-source AI agent orchestration platform have exposed sensitive data and allowed unauthenticated command execution on servers and developers' machines, with two rated critical and one carrying a maximum CVSS score of 10.0.
infrastructure 2026.416.0
The two authenticated-mode findings were fixed in Paperclip 2026.416.0, which requires instance administrator privileges for new-company imports.
organisation Keeper Security
Darren Guccione, CEO at Keeper Security, said the findings pointed to "a systemic failure in how AI agent control planes handle identity boundaries."
Tactical Metrics
Metrics
infrastructure
‎416.0
Software Version
The source tagged as Paperclip v2026.416.0 contains the import-authorization fix and hostname-validation guard discussed below, although the DNS-rebinding advisory does not identify a patched version.
Operators should update to v2026.416.0 or later and review how registration and deployment exposure are configured.
Paperclip fixed CVE-2026-41679 in v2026.416.0 by requiring instance-administrator access for imports targeting a new company and company access for imports targeting an existing one.
The GitHub security release is v2026.416.0, while the server and CLI manifests inside that tag report version 0.3.1.
The code tagged as v2026.416.0 contains the relevant fixes, while the DNS-rebinding advisory still lacks a patched-version entry and NVD retains older affected-version metadata in its history.
Paperclip's release notes tell all deployments to upgrade, and Oasis recommends v2026.416.0 or later.
Metrics
infrastructure
‎Macos
Affected Product
The documented proof of concept was verified on macOS with Firefox, so the public record does not establish the same end-to-end result across every browser and operating system.
Metrics
infrastructure
‎0.3.1
Software Version
The GitHub security release is v2026.416.0, while the server and CLI manifests inside that tag report version 0.3.1.
Metrics
infrastructure
‎2026.416.0
Software Version
The two authenticated-mode findings were fixed in Paperclip 2026.416.0, which requires instance administrator privileges for new-company imports.
Intelligence Sources
The Hacker News 2026-08-05
Infosecurity-Magazine 2026-08-05