Executive brief
Paperclip is an open-source application for managing AI agents in a multi-tenant environment. A critical authorization flaw in the API key management endpoints allows any authenticated user—even one with no company memberships—to mint valid API tokens for agents belonging to other companies. An attacker can use these stolen tokens to read sensitive company data (issues, approvals, agent configuration) and perform administrative actions on victim agents. This completely bypasses Paperclip's tenant isolation security model.
Technical details
The vulnerability is a missing authorization check in three API handlers in server/src/routes/agents.ts (lines 2050–2087): POST /api/agents/:id/keys, GET /api/agents/:id/keys, and DELETE /api/agents/:id/keys/:keyId. These endpoints call assertBoard() to verify the caller is authenticated, but never call assertCompanyAccess() to verify the caller belongs to the agent's company. The root cause is that agent API keys are created with the victim agent's companyId bound server-side; when resolved via the authentication middleware, any bearer token for that key is treated as belonging to the victim tenant. An unauthenticated attacker can sign up, obtain an agent ID (which leaks via activity feeds and other endpoints), then POST to mint a plaintext pcp_* token for any agent. The same authorization bypass pattern exists in agent lifecycle handlers (pause, resume, terminate, delete). The vulnerability requires authenticated mode and sign-up enabled (both default configurations). A patch is available in version 2026.416.0.
Affected products
- Paperclip AI @paperclipai/server <= 2026.411.0-canary.8
Timeline
- 2026-04-16: disclosed: GHSA-47wq-cj9q-wpmp published
- 2026-04-16: patched: Patch released in version 2026.416.0