Executive brief
Paperclip is an AI agent orchestration platform that allows companies to create and manage AI agents. An unauthenticated attacker can gain complete remote code execution on any publicly accessible Paperclip instance with default configuration by exploiting a chain of authorization flaws. This allows an attacker to fully compromise the server and run arbitrary commands with the application's privileges, potentially exposing sensitive customer data and AI agent workflows.
Technical details
The vulnerability chains four independent flaws: (1) open signup with no email verification (PAPERCLIP_AUTH_DISABLE_SIGN_UP defaults to false and email verification is hardcoded off), (2) unauthenticated CLI auth challenge creation with no actor validation, (3) CLI challenge approval that lacks cross-user checking (approver not validated as creator), and (4) the critical flaw: the company import endpoint at /import bypasses instance admin authorization checks that exist on direct company creation. The import endpoint accepts a .paperclip.yaml file with arbitrary agent adapter configuration; the process adapter directly calls spawn() without sandboxing. An attacker can chain these flaws: create an account, self-approve a CLI token, obtain a persistent API key, then import a malicious company bundle with shell commands in the adapter config to achieve RCE. The entire attack requires six unauthenticated API calls with no user interaction. Patches are available in version 2026.416.0 or later.
Affected products
- Paperclip AI Paperclip < 2026.416.0
- Paperclip AI paperclipai < 2026.416.0
Timeline
- 2026-04-10: disclosed: Vulnerability published as GHSA-68qg-g8mg-6pr7
- 2026-04-10: patched: Version 2026.416.0 released with fix