Critical Flaws in Paperclip AI Control Plane Enable Remote Code Execution

Security researchers from Oasis Security have uncovered three critical vulnerabilities in Paperclip, an open-source AI agent control plane. The flaws allow attackers to execute arbitrary host commands and leak sensitive system metadata, exposing a significant security gap in how AI orchestration platforms manage trust.

The most severe discovery, tracked as CVE-2026-41679, is a high-severity remote code execution (RCE) chain. This vulnerability allows unauthenticated users to self-register and gain board-level API access via the command-line interface. Once this access is established, an attacker can import a malicious '.paperclip.yaml' configuration file to execute operating system commands directly on the host.

Beyond the RCE chain, researchers identified a DNS rebinding flaw with a CVSS score of 9.6. This vulnerability specifically targets developers using Paperclip in 'local_trusted' deployment mode, where an attacker-controlled webpage could trigger command execution on the developer's local machine. Additionally, the team found that several API endpoints lacked proper authentication or tenant-level authorization, leading to the leakage of deployment metadata, skill documentation, and internal workflow information.

The Risk of Agentic AI

Paperclip is built using Node.js and React to act as a "company" control plane, allowing businesses to manage teams of autonomous AI agents by defining their goals, tasks, and budgets. However, these vulnerabilities highlight a systemic risk in the emerging agentic AI ecosystem: the tendency to treat agent configurations as static data rather than executable code.

Because AI agents are often granted broad permissions to interact with networks and filesystems to perform their duties, a compromise of the control plane is not limited to data theft. An attacker who controls an agent configuration gains the ability to direct privileged actions across every system that the agent can reach. This suggests that traditional access controls may be insufficient for the unique requirements of autonomous actors.

Remediation and Next Steps

Paperclip has addressed these security gaps in versions 2026.416.0 and 0.3.1. The updates introduce critical security hardening, including hostname validation to thwart DNS rebinding attacks and a requirement for administrator privileges when performing company imports.

Users of the platform are urged to update immediately to the patched versions. Industry observers will now be watching whether other AI orchestration tools—which often share similar architectural patterns of importing YAML-based configurations—possess similar vulnerabilities in their identity boundary management.