A critical bug in the AI management platform Paperclip let an attacker exploit flaws in Paperclip’s authentication and authorization flow and then elevate that account’s privileges, import a malicious agent config, and finally achieve arbitrary code execution.Sagi Layani, the solutions architect at Oasis Research who led the team that found CVE-2026-41679, noted that the 10.0 authorization bypass bug was serious because in practical terms, any affected Paperclip instance reachable by an attacker could be taken over. “Agent platforms are often connected to credentials and sensitive information, so compromising the control plane may give an attacker access to far more than the application itself,” said Layani.Eli Ainhorn, senior vulnerability researcher at Noma Labs, explained that whether it’s Paperclip, OpenClaw, RufRoot, or GitLost, we're seeing the exact same failure across the AI landscape: developer tools default to dangerous network permissions and treat untrusted inputs as safe instructions, handing remote attackers immediate control over local workstations, underlying servers, and enterprise data.
Ainhorn said the security issues Oasis uncovered in Paperclip and OpenClaw mirror findings over the last month from Noma Labs in vulnerabilities like RufRoot and GitLost. Ainhorn said across all four cases, AI orchestration tools concentrate extreme privilege such as system shell access, persistent memory storage, API keys, and private codebase access behind weak or missing trust boundaries.“Attackers no longer need complex exploits to breach these platforms,” said Ainhorn. “Instead, they leverage basic design flaws, including unauthenticated local endpoints, unthrottled loopback interfaces, or untrusted external inputs like public issue tickets to manipulate how the agent operates.”Denis Calderone, chief technology officer at Suzu Labs, added that Paperclip orchestrates AI agents and manages their credentials, execution, and access to host resources. The process adapter was designed to let agents execute system commands with full OS privileges, which means the authorization checks in front of it are the only thing between an outsider and arbitrary code execution on a server,” said Calderone.“When one of those checks is missing, the whole chain collapses,” said Calderone.Calderone said of the other two bugs the Oasis team found, teams should fix the DNS rebinding bug: it carries a CVSS 9.6 and for good reason.Paperclip's local development mode binds to loopback and treats every request hitting that address as an implicit instance administrator. Calderone said the assumption is that only trusted local software can reach 127.0.0.1, but browsers can.An attacker-controlled webpage uses DNS rebinding to redirect requests to loopback while keeping same-origin intact, and suddenly Paperclip accepts attacker requests as administrator actions. From there the attacker imports a malicious agent configuration and executes commands on the developer's machine.“Think about what developers running these platforms locally have access to,” said Calderone. “Source repositories, API keys, cloud credentials, SSH keys. Code execution on that workstation through an AI orchestration platform is a straight path to a supply chain compromise. If your teams are running Paperclip or any similar AI agent platform locally, make sure local dev mode requires explicit authentication and validates hostnames rather than trusting everything on loopback.”Calderone added that the third finding, missing authorization on several API routes, exposed agent health data and documentation. “Worth patching, but not in the same class as the other two,” noted Calderone.
Ainhorn said the security issues Oasis uncovered in Paperclip and OpenClaw mirror findings over the last month from Noma Labs in vulnerabilities like RufRoot and GitLost. Ainhorn said across all four cases, AI orchestration tools concentrate extreme privilege such as system shell access, persistent memory storage, API keys, and private codebase access behind weak or missing trust boundaries.“Attackers no longer need complex exploits to breach these platforms,” said Ainhorn. “Instead, they leverage basic design flaws, including unauthenticated local endpoints, unthrottled loopback interfaces, or untrusted external inputs like public issue tickets to manipulate how the agent operates.”Denis Calderone, chief technology officer at Suzu Labs, added that Paperclip orchestrates AI agents and manages their credentials, execution, and access to host resources. The process adapter was designed to let agents execute system commands with full OS privileges, which means the authorization checks in front of it are the only thing between an outsider and arbitrary code execution on a server,” said Calderone.“When one of those checks is missing, the whole chain collapses,” said Calderone.Calderone said of the other two bugs the Oasis team found, teams should fix the DNS rebinding bug: it carries a CVSS 9.6 and for good reason.Paperclip's local development mode binds to loopback and treats every request hitting that address as an implicit instance administrator. Calderone said the assumption is that only trusted local software can reach 127.0.0.1, but browsers can.An attacker-controlled webpage uses DNS rebinding to redirect requests to loopback while keeping same-origin intact, and suddenly Paperclip accepts attacker requests as administrator actions. From there the attacker imports a malicious agent configuration and executes commands on the developer's machine.“Think about what developers running these platforms locally have access to,” said Calderone. “Source repositories, API keys, cloud credentials, SSH keys. Code execution on that workstation through an AI orchestration platform is a straight path to a supply chain compromise. If your teams are running Paperclip or any similar AI agent platform locally, make sure local dev mode requires explicit authentication and validates hostnames rather than trusting everything on loopback.”Calderone added that the third finding, missing authorization on several API routes, exposed agent health data and documentation. “Worth patching, but not in the same class as the other two,” noted Calderone.
