The short answer
A CVSS 10.0 remote code execution vulnerability in Paperclip — an open-source AI agent control plane — lets a completely unauthenticated attacker run arbitrary OS commands on the server by importing a malicious .paperclip.yaml agent manifest. No prior account or victim interaction is needed. The flaw chains open self-registration, a self-approvable CLI auth flow, and a missing authorization boundary in the agent-import route. Two further bugs add cross-tenant data exposure and local agent takeover to the picture. All three are fixed in v2026.416.0. A public Metasploit module (Rapid7) is already available, meaning exploitation is accessible to a wide attacker pool.
What is Paperclip?
Paperclip is an open-source platform for teams that run and manage fleets of AI agents. It provides a central control plane: agent registration, credential management, scheduling, and a wake-up lifecycle that tells individual agents to begin processing. Teams building AI agent systems in production — whether for document automation, enterprise data pipelines, or multi-agent orchestration — commonly adopt platforms like Paperclip to centralize operational control over many agents running in parallel.
The platform's architecture makes the control plane a high-value target. It holds credentials for every registered agent and, in default configurations with open self-registration, accepts account creation from anyone who can reach the server over the network.
Three flaws, one critical chain
CVE-2026-41679 — Unauthenticated RCE via import, CVSS 10.0
The most severe vulnerability requires no pre-existing account and no interaction from a legitimate user. An attacker exploits three weaknesses in sequence to reach remote code execution on the server's operating system.
Cross-tenant data exposure
A second flaw allows a user authenticated in one tenant to read agent data belonging to a separate company context. In multi-tenant Paperclip deployments — a common configuration in managed service offerings — this means one customer's agents, credentials, and task history are readable by another. The flaw was fixed in the same v2026.416.0 release.
Local agent takeover
A third vulnerability allows an authenticated user to hijack an agent running under a different company context on the same Paperclip instance. Combined with the cross-tenant read flaw, this gives a lower-privileged attacker a realistic path to lateral movement across tenants without requiring the critical unauthenticated chain. Also fixed in v2026.416.0.
How CVE-2026-41679 works step by step
The CVE-2026-41679 attack works by chaining three independent weaknesses that, individually, might not appear severe:
- Open self-registration. Paperclip's default configuration allows anyone to create an account without email verification. The attacker registers a fresh account with no interaction from existing users.
- Self-approvable CLI authorization. Paperclip's CLI authorization flow presents a challenge that an independent approver is supposed to confirm. The flow did not enforce that the approver must be a different account. The attacker approves their own challenge request, minting a persistent board-level API credential entirely under their control.
- Weak authorization on the import path. Paperclip restricted direct company creation to instance administrators. The functionally equivalent import path only required board-level access. Using the board-level credential from step two, the attacker calls the import route with a
.paperclip.yamlmanifest that defines a new company and registers an agent using Paperclip's process adapter — a legitimate feature that launches a specified command as a child process of the Paperclip server. Calling the wake endpoint for that agent runs the attacker-chosen command with the Paperclip server's operating-system privileges.
The result is full remote code execution as the server process with no prior foothold, no user interaction, and no credential brute-forcing required. Rapid7 published a Metasploit module automating the full six-request chain, putting exploitation within reach of less sophisticated actors.
What it means for US & EU software teams
If you run Paperclip on a network-accessible host with default self-registration enabled, you were fully exploitable before the patch. Network segmentation or firewall rules that prevent arbitrary inbound connections to your Paperclip instance would have limited the blast radius, but the vulnerability requires no authenticated starting point.
The Metasploit module compresses the exploitation timeline. The original vulnerability required understanding the six-step chain. With Rapid7's public module, any operator who can point Metasploit at a reachable Paperclip server can attempt the attack. This is the practical definition of widespread, commodity exploitation risk — act on patching before it becomes routine scanning activity.
AI agent control planes are infrastructure, not just tooling. The core lesson from this disclosure is that platforms managing AI agent fleets carry the same security obligations as API gateways or identity providers — they hold credentials, they authorize actions, and they execute code on behalf of those agents. The authorization gap in the import path reflects a pattern we see in maturing platforms: core admin functions get protected, but adjacent paths with equivalent power receive less scrutiny. Applying security audit discipline to AI agent infrastructure — including agent import and wake endpoints — is now part of responsible production AI deployment.
Cross-tenant and agent takeover flaws compound the risk for SaaS and multi-tenant products. For teams that offer a managed AI agent service built on Paperclip, or that run Paperclip in a shared infrastructure environment, the cross-tenant data exposure and agent takeover vulnerabilities are potentially as damaging as the RCE. A breach of tenant isolation in a FinTech or HealthTech context would constitute a personal data breach under GDPR, triggering 72-hour DPA notification obligations. NIS2 entities should document the remediation and update their security management records accordingly.
FinTech and HealthTech teams face the sharpest consequences. If an AI agent registered in Paperclip has read or write access to customer financial records, patient data, or payment system APIs, the window before patching represents a potential regulatory exposure. Map which tools your agents can invoke, confirm no unauthorized import requests reached your server, and document the patch timeline as evidence for SOC 2, DORA, and EU AI Act governance records.
What to do now
| Action | Priority | Notes |
|---|---|---|
| Upgrade Paperclip to v2026.416.0 | Immediate | Fixes all three CVEs |
| Disable open self-registration or require email verification | Immediate | Closes step 1 of the attack chain as a defense-in-depth measure |
| Audit server logs for unauthorized company-import requests | This sprint | Look for imports targeting new companies from unexpected accounts |
| Audit agent registry for process-adapter entries with sensitive commands | This sprint | Any process adapter pointing to a shell or privileged binary is a risk |
| Confirm network segmentation prevents arbitrary inbound access to Paperclip | This sprint | Should not be internet-facing without authentication and network controls |
| Add Paperclip to CI dependency and vulnerability scanning | This sprint | Catch future CVEs before deployment |
| Document patch evidence for SOC 2, DORA, EU AI Act records | Within 30 days | Required for regulated FinTech, HealthTech, logistics environments |
Sources: The Hacker News — Paperclip AI Flaws Let Attackers Run Host Commands via Malicious Agent Imports (August 2026); SecurityWeek — Critical Paperclip Flaw Allowed Admin Access, Code Execution (August 2026); Infosecurity Magazine — Paperclip AI Flaws Let Unauthenticated Attackers Run Commands (August 2026).
FAQ
What is CVE-2026-41679 in Paperclip?
CVE-2026-41679 (CVSS 10.0) is an unauthenticated remote code execution flaw in Paperclip, an open-source AI agent control plane. An attacker with no pre-existing account chains Paperclip's open self-registration, a self-approvable CLI authorization flow, and a missing authorization check in the company-import route to plant a .paperclip.yaml manifest containing a process-adapter agent. Waking that agent runs an arbitrary OS command as the Paperclip server process. Fixed in v2026.416.0.
What other vulnerabilities were disclosed alongside CVE-2026-41679?
Two additional flaws were reported. A cross-tenant data exposure vulnerability allows a user authenticated in one company context to read agent data belonging to another tenant — a critical issue in multi-tenant or managed service deployments. A local agent takeover flaw lets an authenticated user hijack agents running under a different company. All three are fixed in Paperclip v2026.416.0.
Who uses Paperclip and should I be concerned?
Paperclip is an open-source control plane for teams managing fleets of AI agents — handling registration, credentials, scheduling, and the wake lifecycle. If your team runs Paperclip in production, on-premises or in a cloud environment, patch to v2026.416.0 immediately. Network-accessible Paperclip instances with default self-registration enabled were fully exploitable from the internet with no prior credential.
What should teams do after patching Paperclip?
After upgrading: audit server access logs for unauthorized import requests and unexpected agent wake events before the patch date; review all registered agents for process-adapter configurations pointing to shells or privileged commands; disable open self-registration or enforce email verification; add Paperclip to your CI vulnerability scanning pipeline; and for regulated environments, record the patching as compliance evidence for SOC 2, DORA, and EU AI Act governance purposes.