Two security flaws in Paperclip could let attackers execute commands on a network server or a developer's computer. Paperclip is an open-source control plane for teams of artificial intelligence (AI) agents, and both paths rely on importing a malicious agent and starting it.
A third flaw could expose sensitive data and control-plane details through application programming interface (API) routes that did not enforce the expected access checks.
The more severe server-side path, tracked as CVE-2026-41679 (CVSS score: 10.0), requires no pre-existing account or victim interaction against network-accessible deployments using authenticated mode with the default registration configuration.
The second path, tracked as GHSA-x8hx-rhr2-9rf7 (CVSS score: 9.6), requires a user to open an attacker-controlled page while Paperclip is running in its default local_trusted mode.
The source tagged as Paperclip v2026.416.0 contains the import-authorization fix and hostname-validation guard discussed below, although the DNS-rebinding advisory does not identify a patched version. Rapid7 has since shipped a public Metasploit module for CVE-2026-41679, and CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) enrichment carried by NVD classifies exploitation as proof-of-concept.
