Critical Paperclip Flaw Allowed Admin Access, Code Execution

The Paperclip vulnerability (CVE-2026-41679) stemmed from a failure to enforce proper authorization checks in the company import feature, allowing any self-registered user — without even verifying their email — to deploy agents with server-level permissions. This represents a classic broken access control flaw where authentication and authorization were treated as interchangeable, leaving a critical privilege escalation path wide open to unauthenticated or low-privilege attackers. The ability to execute arbitrary code at the server process level means a successful exploit could lead to full system compromise, data exfiltration, lateral movement, and persistent backdoors. AI management platforms are high-value targets because they often operate with elevated permissions and broad network access, amplifying the blast radius of any compromise. Organizations running Paperclip should treat this as an urgent remediation priority given the trivial exploitation path.