Paperclip AI Flaws Let Attackers Run Host Commands via Malicious Agent Imports

Two critical vulnerabilities in Paperclip, an open-source control plane for AI agents, could allow attackers to execute arbitrary commands on a server or developer’s machine. The most severe, CVE-2026-41679 (CVSS 10.0), affects network-accessible deployments with open registration, enabling unauthenticated attackers to self-approve credentials and import a malicious agent that runs commands with server privileges. The second, GHSA-x8hx-rhr2-9rf7 (CVSS 9.6), exploits a DNS rebinding attack against the default local_trusted mode, letting a malicious webpage execute commands on the developer’s host. A third flaw, GHSA-xfqj-r5qw-8g4j (CVSS 8.3), involves missing access checks on API routes, exposing sensitive data. Paperclip fixed these in v2026.416.0, which adds import authorization and hostname validation. Rapid7 released a Metasploit module for CVE-2026-41679, and CISA’s SSVC enrichment marks it as proof-of-concept. No in-the-wild exploitation was reported as of August 5, 2026. Operators should upgrade immediately and review registration and deployment exposure.