Executive brief
Paperclip is an open-source agent management platform. A flaw in its codex_local runtime allows it to inherit and use Gmail connectors that were configured only in the OpenAI/ChatGPT app ecosystem, without explicit user authorization in Paperclip itself. An attacker or misconfigured agent can read emails, search mailboxes, and send real emails from the user's Gmail account. Combined with unsafe default settings that disable approval workflows, this could lead to unauthorized email access and outbound communication.
Technical details
The vulnerability is a privilege escalation and trust boundary violation (CWE-284) in Paperclip's codex_local runtime. The root cause is that codex_local inherits OpenAI-connected app state (specifically Gmail connectors cached in codex-home/plugins/cache/openai-curated/gmail/) without explicit Paperclip-side authorization. The attack vector is local/network (creation of a codex_local agent) with user interaction (agent task execution). Preconditions: Gmail must be connected in OpenAI/ChatGPT UI, and a codex_local agent must be created. An attacker can call mcp__codex_apps__gmail_get_profile, mcp__codex_apps__gmail_search_emails, and mcp__codex_apps__gmail_send_email to read and exfiltrate email and send unauthorized messages. The issue is amplified by dangerouslyBypassApprovalsAndSandbox defaulting to true, bypassing approval gates. As of the advisory date (April 2026), no patch is available (last affected version 2026.403.0).
Affected products
- Paperclip paperclipai 2026.403.0 and earlier
Timeline
- 2026-04-16: disclosed