Executive brief
Paperclip, an AI agent platform, contains multiple API endpoints that fail to verify user identity even when configured in 'authenticated' mode. This allows unauthorized individuals to access sensitive internal data, including agent instructions and system configurations, and perform certain administrative actions without a password or API key. Such exposure can lead to the theft of proprietary agent logic and serve as a starting point for more complex attacks against the infrastructure.
Technical details
Multiple endpoints in Paperclip's server component lack authentication checks (CWE-306), even when the deployment is set to 'authenticated' mode. Specifically, the heartbeat run issues endpoint (/api/heartbeat-runs/:runId/issues), CLI auth challenge creation (/api/cli-auth/challenges), and various skill/agent instruction endpoints (/api/skills/*) are accessible without credentials. An unauthenticated attacker can perform reconnaissance by mapping the internal API, leak sensitive agent coordination protocols, and initiate CLI authentication challenges which can be used as a building block for further exploitation. The vulnerability is addressed in version 2026.416.0 by implementing proper authentication middleware and access checks across these routes.
Affected products
- Paperclip @paperclipai/server < 2026.416.0
Timeline
- 2026-04-16: disclosed
- 2026-04-16: patched
- 2026-04-16: advisory