Paperclip AI Flaws Let Attackers Run Host Commands via Malicious Agent Imports — Threadlinqs Intelligence
As of 2026-08-06, Paperclip AI Flaws Let Attackers Run Host Commands via Malicious Agent Imports is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-1892 · Severity: CRITICAL · CVSS: 10 · Status: ACTIVE · Category: VULNERABILITY
Updated: 2026-08-06 · revalidated 1× · latest source
Three critical vulnerabilities disclosed in Paperclip, an open-source AI agent control plane, allow unauthenticated remote code execution, DNS-rebinding drive-by attacks, and unauthorized API access.
Paperclip is an open-source Node.js/React orchestration platform described as a 'control plane' for managing teams of AI agents to run a business. It supports multiple agent adapters including a process adapter that executes arbitrary shell commands on the host via Node.js child_process.spawn() with shell:true and zero sandboxing. Oasis Security disclosed three vulnerabilities in Paperclip, all stemming from the same root cause: the platform treats agent configuration as inert data rather than executable input, and it trusted a credential, a route, or a network location without applying the authorization check the later operation required.
**CVE-2026-41679 (CVSS 10.0, CRITICAL) — Unauthenticated Remote Code Execution**
The attack chains four independent flaws: (1) open registration is enabled by default with email verification hardcoded off, allowing anyone to sign up; (2) the POST /api/cli-auth/challenges endpoint creates a CLI authentication challenge with no actor check, and the approval logic fails to verify the approver is not the challenge creator, enabling self-approval of a persistent board API key; (3) the POST /api/companies/import endpoint lacks the assertInstanceAdmin check for new_company mode, unlike the direct company creation endpoint; (4) the process adapter passes user-supplied command and args directly to spawn() with shell:true and no input validation, sandboxing, or character filtering. The full six-request chain is fully automated. Rapid7 shipped a Metasploit module (exploit/linux/http/paperclipai_unauth_rce_cve_2026_41679, ExcellentRanking) in June 2026 automating the attack. CISA-ADP SSVC analysis marks exploitation as 'poc confirmed', automatable 'yes', and technical impact 'total'. Affected versions: < 2026.410.0 (or < 2026.416.0 per some sources).
**GHSA-x8hx-rhr2-9rf7 (CVSS 9.6, CRITICAL) — DNS Rebinding / Drive-by RCE**
Paperclip's default local_trusted mode binds to loopback and treats every request as an implicit instance administrator — no token, session, or authentication is required. The hostname guard (private-hostname-guard.ts) only activates in authenticated+private mode, not local_trusted. An attacker registers a domain with two DNS A records (both TTL=0): one pointing to the attacker's server IP, one pointing to 127.0.0.1. The victim visits the attacker's page; the browser connects to the attacker's IP first. The attacker serves a malicious HTML page with exploit JavaScript, then shuts down their server. The browser retries the same hostname, now resolving to 127.0.0.1 — the Paperclip local instance. The browser sees a single origin throughout, bypassing CORS. The JS calls POST /api/companies/import to import a malicious agent bundle with a process adapter, then POST /api/agents/:id/wakeup to execute arbitrary commands on the victim's machine with Paperclip server OS privileges. Verified on macOS with Firefox. Affected versions: < 0.3.1.
**GHSA-xfqj-r5qw-8g4j (CVSS 8.3, HIGH) — Missing API Authentication**
Multiple API endpoints in authenticated mode either lack authentication entirely or fail to enforce tenant-level authorization. The GET /api/health endpoint leaks deployment mode, exposure setting, auth status, bootstrap status, version, and feature flags (reconnaissance data). The GET /api/heartbeat-runs/:runId/issues endpoint returns issue data for a heartbeat run without calling assertCompanyAccess, unlike every other endpoint in the same file. The GET /api/skills/index, /api/skills/:skillName endpoints expose agent instructions, system prompts, internal API endpoints, parameters, and authentication conventions. The POST /api/cli-auth/challenges endpoint creates a CLI auth challenge with no actor check, forming part of the credential-generation chain used in CVE-2026-41679. The root design flaw: unauthenticated requests pass through middleware with a 'no actor' identity, leaving each route to remember its own assertion. Affected versions: < 0.3.1 (patched in 2026.416.0).
**Imp
Weaknesses (CWE)
CWE-287, CWE-862, CWE-1188, CWE-306, CWE-78
Target sectors: technology, software-development, artificial-intelligence, startups, devops
Target regions: Global
Detections & IOCs
As of 2026-08-25, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-41679, T1592, T1190, T1059, T1505, T1082, T1071
