Paperclip cross-tenant agent API token minting in agent routes

Executive brief

Paperclip is an AI agent platform used to manage automated tasks and workflows. A security flaw allows any registered user to generate secret access tokens for agents belonging to other organizations on the same server. An attacker can use these tokens to steal sensitive company data, view private issues and approvals, or disrupt operations by pausing and deleting agents.

Technical details

A broken access control vulnerability exists in 'server/src/routes/agents.ts' where multiple endpoints (GET/POST/DELETE /api/agents/:id/keys and agent lifecycle routes) only verify that a user is authenticated ('assertBoard') but fail to verify company-level ownership ('assertCompanyAccess'). An authenticated attacker can provide a victim agent's ID to mint a new plaintext API token. Because the backend binds this new token to the victim's 'companyId', the attacker can use it as a Bearer token to bypass all subsequent tenant isolation checks, gaining full read/write access to the victim's data. The vulnerability also extends to agent lifecycle management, allowing unauthorized pausing, termination, or deletion of agents across tenants. This was patched in version 2026.416.0.

Affected products

• paperclipai paperclip < 2026.416.0

Timeline

• 2026-04-16: advisory: GHSA-47wq-cj9q-wpmp published
• 2026.416.0: patched

References

• https://api.github.com/users/peaktwilight
• https://github.com/peaktwilight
• https://api.github.com/users/peaktwilight/gists%7B/gist_id%7D
• https://api.github.com/users/peaktwilight/repos
• https://avatars.githubusercontent.com/u/77903714?v=4
• https://api.github.com/users/peaktwilight/events%7B/privacy%7D