Executive brief
Paperclip is an AI agent platform that allows users to create custom skills (plugins) to extend agent capabilities. A critical vulnerability allows malicious skills to execute arbitrary shell commands on the Paperclip server, exposing all sensitive environment variables including API keys, database credentials, and authentication secrets. An attacker who can install or trick an agent into loading a malicious skill can compromise the entire server and access customer data.
Technical details
This is an arbitrary code execution (ACE) vulnerability in the workspace runtime service. The root cause is in server/src/services/workspace-runtime.ts, where the `spawn()` function executes shell commands from the runtimeConfig parameter with no input sanitization. An attacker can call PATCH /api/projects/{projectId}/workspaces/{workspaceId} to set a malicious runtimeConfig, then trigger command execution via POST /api/projects/{projectId}/workspaces/{workspaceId}/runtime-services/start. The attack precondition is that an agent must load or a user must install the malicious skill; no authentication bypass is required if the agent is already compromised. The demonstrated impact includes exfiltration of OPENAI_API_KEY, database credentials, JWT secrets, and full server compromise. A patch is available in version 2026.416.0.
Affected products
- Paperclip Paperclip <2026.416.0
Timeline
- 2026-04-16: disclosed