Paperclip CVE-2026-41679: 6 API Calls from Public Registration to AI Agent Host Process RCE

1. Basic Information

• Article Title: Critical Paperclip Flaw Allowed Admin Access, Code Execution
• Publisher: SecurityWeek
• Publication Date: August 6, 2026
• Original Source: SecurityWeek
• Related Sources: CERT Santé / GHSA-68qg-g8mg-6pr7
• Related CVE & Products: CVE-2026-41679, Paperclip AI agent orchestration, @paperclipai/server, paperclipai
• Affected Versions: Versions prior to 2026.416.0. Fixed in version 2026.416.0
• Severity: Critical

2. Executive Summary

This is an attack chain on internet-exposed Paperclip instances. An attacker registers an account, self-approves a CLI key, and abuses an alternative import path for admin-only company creation. Finally, they use an unsandboxed process adapter in .paperclip.yaml to execute arbitrary commands with server privileges.

3. Attack Flow

Chain A: Remote Server Takeover

1. Register a new account without email verification.
2. Create a CLI challenge and approve it themselves to get a permanent board API key.
3. Call POST /api/companies/import in new_company mode.
4. Bypass the instance-admin check (which exists in direct company creation) via the import route.
5. Put a process adapter and malicious command/args into the .paperclip.yaml import bundle.
6. Call the imported agent's wakeup endpoint to execute commands via Node.js spawn() as the server user.

Chain B: Local-Dev DNS Rebinding (Alternative Flaw)

1. A developer visits an attacker's website.
2. DNS rebinding reaches the loopback Paperclip API from the browser.
3. Send agent/import commands to the local API.
4. Execute commands on the developer's device.

4. Attacker Position and Execution Context

• The remote chain is executed by an external attacker with HTTP access to the Paperclip API.
• Commands run within the OS user, filesystem, and network context of the Paperclip server process.
• The local-dev chain uses the victim's browser as a relay to reach the loopback instance.
• Subsequent targets include source repositories, agent credentials, databases, and internal services.

5. Visibility for Administrators and Victims

Administrators will see new general user registrations, CLI challenges/approvals, board keys, company imports, and agent wakeups. On the host side, shells or network tools spawned by Paperclip/Node.js will appear. Because these mix with normal agent operations, correlation between agent control-plane audits and OS telemetry is required.

6. Conditions for Success and Failure

Conditions for Success

• Reaching the API on versions prior to 2026.416.0.
• Open sign-up enabled without email verification.
• Ability to self-approve CLI challenges.
• Absence of instance-admin checks on imports.
• Process adapters executing host commands without a sandbox.

Conditions for Failure

• Updating to version 2026.416.0 or later.
• Disabling public sign-up and enforcing email verification.
• Enforcing instance-admin checks and company scopes on imports/previews.
• Sandboxing and allowlisting process adapters.
• Restricting the API to VPNs or private networks.

7. Impact of Successful Exploitation

An attacker can access the Paperclip database, agent definitions, source code, server filesystem, and API keys or cloud credentials held by agents. They can also pivot into the internal network and add or modify agents to create persistent automated execution paths.

8. Observable Logs

• Email: Rapid account creation and use without verification. (Email origin is not strictly required).
• Proxy/SWG/DNS: External access to Paperclip ports/APIs, DNS rebinding, and unknown outbound connections from the server.
• Endpoint/EDR: node/Paperclip spawning sh, bash, cmd, or PowerShell; new file creation; credential access.
• Identity/IdP: Sign-up → CLI challenge → same-user approval → board key.
• SaaS/Cloud: New company imports, process adapter usage, agent wakeups, and agent credential/API usage.
• Network: Rapid API calls, internal network scans, and metadata/secret service access.

9. Attack Success Criteria

• Contact Only: Sign-up, page visits, or API probes.
• User Action: Not required for the remote chain. DNS rebinding requires the user to visit a website.
• Initial Execution: Successful CLI key creation and company import.
• Malware / Auth Success: Child process generation by a process adapter command.
• Data Theft / Session Compromise: Outbound use of filesystem, database, source code, or credentials.
• Post-Exploitation Confirmation: Agent modification, internal service access, or cloud API activity.

10. Investigation Playbook

• Trigger: Unapproved sign-ups, CLI self-approval, new_company imports, and Paperclip child shells.
• Initial Check: Connect users, keys, companies, agents, commands, and child processes using request IDs and timestamps.
• Endpoints: Preserve the server filesystem, processes, container layers, persistence mechanisms, and egress logs.
• Authentication & Cloud: Revoke board keys and rotate all secrets and API tokens accessible by agents.
• Post-Exploitation: Conduct cross-investigations of source repositories, CI/CD pipelines, Kubernetes clusters, cloud environments, and internal services.
• Containment: Stop external access, upgrade software, rebuild instances, rotate keys, and delete malicious agents.
• Severity Levels: Exposed / Account Created / Board Key / Import / Host RCE / Secret Theft / Lateral Movement.

11. Defense and Detection Ideas

• Single Events: Same-user CLI approval, regular user new_company imports, process adapters, and Node child shells.
• Timeline Correlation: Sign-up → challenge → self-approval → import → wakeup → shell/egress.
• Threat Hunting: Search for process adapters in .paperclip.yaml, abnormal commands, unknown companies, and agent wakeup bursts.
• Log Gaps: Missing API bodies, approver identities, import bundles, agent config versions, and child processes/networks.
• Priority Actions: Upgrade software, close registration, test authorization, implement sandboxing, and inventory/rotate secrets.

12. Facts / Inference / Hypothesis

Facts

• Attackers successfully chained open registration, CLI challenge self-approval, missing import authorization, and an unsandboxed process adapter.
• Reports indicate the attack chain can be automated in 6 API calls.
• Commands were executed with the privileges of the Paperclip server process.
• The vulnerability was fixed in version 2026.416.0.

Inference

• Instances with confirmed RCE should be treated as having compromised all secrets accessible to their agents.
• Rebuilding the host alone is insufficient because agent definitions themselves can act as persistence mechanisms.

Hypothesis

• Other agent orchestration products besides Paperclip may also suffer from authorization discrepancies in alternative import paths.
• Short attack chains from sign-up to host shells can be detected with high precision using behavior correlation.

13. MITRE ATT&CK Mapping

• High Confidence: T1190 Exploit Public-Facing Application, T1136 Create Account, T1098 Account Manipulation, T1059 Command and Scripting Interpreter, T1105 Ingress Tool Transfer.
• Medium Confidence: T1552 Unsecured Credentials, T1528 Steal Application Access Token, T1505 Server Software Component, T1021 Remote Services, T1557 Adversary-in-the-Middle (DNS rebinding chain).

14. Unknowns and Additional Investigation

• The number of public instances and whether actual exploitation occurred.
• Exact request/body IOCs and the distribution range of PoCs.
• Deployments running on non-default ports.
• Secrets held by agents and internal network reachability.
• The scope of persistence achieved by malicious companies and agents.

15. Impact on SOCs and General Organizations

AI agent management platforms centrally store credentials for cloud environments, source code repositories, CI/CD pipelines, and SaaS applications. Organizations must immediately audit public exposure and open sign-ups—even for PoC or internal testing environments—and treat control-plane logs and host child-process logs as a single incident.

16. Summary by Role

• For SOCs: Correlate events from sign-ups to wakeups and Node child shells. Retrospectively investigate agent definitions and secret usage.
• For Administrators: Update to version 2026.416.0 or later, disable public sign-ups, enforce private access, and restrict process adapters.
• For End Users: No user action is required. Follow administrators' instructions regarding stopping and reissuing agent/API keys.