Three vulnerabilities in an open-source AI agent orchestration platform have exposed sensitive data and allowed unauthenticated command execution on servers and developers’ machines, with two rated critical and one carrying a maximum CVSS score of 10.0.
According to new research by Oasis Security published on August 4, the flaws affect Paperclip, a control plane its developers describe as a platform for operating zero-human companies. Oasis identified all three bugs during an assessment of its authenticated and local deployment modes.
The findings follow a run of similar disclosures, including a critical Flowise flaw and a Langflow bug exploited within 20 hours.
From Self-Registration to Code Execution
CVE-2026-41679 (CVSS 10.0) affected authenticated deployments. Paperclip allowed self-registration without email verification, and its CLI authorization flow let a new user approve their own credential challenge, turning that account into a persistent board-level API key with no separate approver.
That key reached the company import route. Paperclip restricted direct company creation to instance administrators, but the equivalent import path checked only for board-level access.
An attacker could use it to introduce a bundle containing an agent configured with the process adapter, a legitimate feature that launches a specified command as a child process. Waking that agent ran the attacker’s command with the server’s operating-system privileges.
A second finding, GHSA-xfqj-r5qw-8g4j (CVSS 8.3), covered several routes that omitted access checks entirely, exposing heartbeat data, agent documentation and health information.
Read more on RCE in AI agent platforms: Critical Flowise Flaw Gives Attackers Full Server Control
A Developer’s Browser as an Attack Path
A third flaw, GHSA-x8hx-rhr2-9rf7 (CVSS 9.6), reached the same execution sink from the opposite direction. Paperclip’s local development mode binds to loopback and treats every request as an implicit instance administrator, an assumption that holds for local clients but not browsers.
DNS rebinding let an attacker-controlled webpage cross that boundary. Once the attacker’s server became unreachable, the browser retried the hostname against loopback while still treating the connection as same-origin. Paperclip accepted the rebound requests as administrator actions, and the page imported and woke a malicious agent, executing commands on the developer’s machine.
Darren Guccione, CEO at Keeper Security, said the findings pointed to “a systemic failure in how AI agent control planes handle identity boundaries.” An attacker controlling an agent configuration does not merely reach data, he said, but can direct privileged action across every system that agent touches.
All three vulnerabilities were patched after disclosure. The two authenticated-mode findings were fixed in Paperclip 2026.416.0, which requires instance administrator privileges for new-company imports. The rebinding flaw was addressed in 0.3.1, enabling hostname validation in local mode.
