[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fB4cb4RK-Bs7gjiJzTHAWwD1P4N3t2O2bZlMzC_27dfI":3},{"article":4,"iocs":50},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":27,"category":28,"article_tags":32},"65a0fbee-9ba7-4fe6-ae11-e4bf563cddf9","Critical Paperclip Flaw Allowed Admin Access, Code Execution","critical-paperclip-flaw-allowed-admin-access-code-execution-548abf","An attacker could self-register, sign in for board-level API access, and import a new company for code execution. The post Critical Paperclip Flaw Allowed Admin Access, Code Execution appeared first on SecurityWeek.","A critical vulnerability in the Paperclip AI management platform, tracked as CVE-2026-41679, allowed remote attackers to gain arbitrary code execution with server-level permissions. The flaw enabled self-registration, bypassing email verification, and then exploiting an authorization bypass in the company import feature to deploy agents that could execute commands as the Paperclip server process. Paperclip has since patched the vulnerability by implementing stricter authorization checks.","Paperclip AI platform flaw allowed arbitrary code execution and admin access.","An authorization bypass in Paperclip could have allowed remote attackers to obtain arbitrary code execution with the server’s permissions, Oasis Security reports. Paperclip is an AI management platform that allows organizations to operate autonomous AI agents at scale. It supports importing companies from portable bundles and YAML files that also define agents and commands they should execute. Tracked as CVE-2026-41679 (CVSS score of 10), the critical security defect impacted network-accessible Paperclip instances with default authenticated-mode configurations. A missing authorization check could be exploited to self-register an account without email verification, sign in to the account, create a CLI challenge and approve it, and then deploy an agent by importing a new company. “A network attacker could create an account and sign in immediately, without an invitation or control of a verified mailbox. That session was enough to enter Paperclip’s CLI authorization flow, a challenge-and-approval process used to authorize a command-line client and activate a persistent board API credential,” Oasis notes in a technical report (PDF). By self-approving the CLI authorization challenge, the attacker would have a board API token tied to their account, gaining board-level API access, including the ability to reach company import routes.Advertisement. Scroll to continue reading. “Paperclip correctly restricted direct creation of a new company to an instance administrator, but the equivalent new-company import path enforced only board-level access. It did not require instance-admin privileges,” Oasis explains. When importing the company, the attacker could use a crafted .paperclip.yaml to specify an agent that would use a host-level execution adapter, and define a command that the adapter would execute as the Paperclip server process. “Successful exploitation provided the permissions of the service account running Paperclip. Depending on deployment, that could include access to application data, source repositories, local credentials, secrets exposed to agent processes, and internal services reachable from the host,” Oasis says. Paperclip fixed the security defect by applying authorization checks to the import preview and import execution flows and tightening company scoping. It also resolved two other bugs discovered by Oasis. One was a missing authorization on API routes, leading to sensitive data disclosure, while the other was a DNS rebinding on loopback weakness that could allow attackers to execute arbitrary code on developer machines. The second issue existed because, in local-development mode, Paperclip would bind to 127.0.0.1 and trust all requests reaching the address as originating from trusted software. If the developer loaded an attacker-controlled website in the browser, JavaScript code on the site would bypass same-origin protections, resulting in access to the local Paperclip API. Through an import operation, the attacker would manipulate Paperclip into executing a command on the developer’s computer. “AI agents are becoming a new class of enterprise identity. Agentic workflows are distributed: a user delegates intent to an agent, the agent invokes other agents or tools, and each step may select a new credential. By the time an action reaches the target system, logs show only the final credential, not the originating user, the responsible agent, or the intended task,” Oasis notes. Related: Cybersecurity Alliance Drafts SAFE Guidelines for Sharing AI Incident Data Related: AI Agents Targeted Real People and Projects During Cybersecurity Tests Related: Rethinking AI Security: Why CASB and DLP Need an Interaction-Aware Layer Related: Critical Ruflo Flaw Lets Attackers Spawn Rogue AI Swarms Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire 311,000 Impacted by Brown Health Medical Group-MA Data BreachAI Agents Targeted Real People and Projects During Cybersecurity TestsCISA Warns of Exploited Langflow, N-central, and Tomcat VulnerabilitiesOver 400 NPM Packages Infected in ChainDrop Supply Chain AttackOligo Raises $60 Million for Runtime SecurityZenity Raises $125 Million in Series C FundingGemini Agent-to-Agent Attack Method Exposed Secrets, Enabled Pull Request TamperingDecades-Old BMC Vulnerability Exposes Thousands of Data Centers to Attacks Latest News Meta AI Hacked External Systems During Cybersecurity TestingBelarusian Ransom Cartel Mastermind Gets 16 Years in PrisonCisco Patches Critical SD-WAN, IOS XE, FMC VulnerabilitiesHackers Start Exploiting Recent JetBrains TeamCity VulnerabilityHow a $50,000 Exploit Chain Turned Bixby Against Samsung Phones Black Hat USA 2026 – Summary of Vendor Announcements (Part 3)The Fourth Battlefield: The Growing Role of Cyber Operations in Global ConflictNew Attack Methods Enable Malware to Hijack Passkey-Protected Accounts Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Rethinking Cyber Defense for AI-Speed Attacks August 18, 2026 Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default. Register Virtual Event: CodeSecCon 2026 August 19, 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Register People on the MoveServiceNow has appointed Simon Mouyal as Chief Marketing Officer.James Wilkinson has been named Chief Information Security Officer for the City of Dallas.PNC Financial Services Group has appointed Christian Winward as CISO.More People On The MoveExpert Insights Rethinking AI Security: Why CASB and DLP Need an Interaction-Aware Layer Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use. (Etay Maor) Timeless Compliance: Why Better Questions Beat Bigger Frameworks The best compliance programs aren't the biggest ones. They're the ones built on a short list of questions that can actually be answered, and that still hold true when the models change. (Matt Honea) Is Patching Dead? Vulnerability Management in the Post-Mythos Era You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win. (Danelle Au) When Identity Verification Fails: Lessons from a Real-World SIM Swap and Near Account Takeover Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge. (Torsten George) Legacy Systems, Real-World Impacts: The Reality of OT Security Legacy systems, safety concerns, and critical infrastructure risks make OT vulnerability disclosure one of cybersecurity's most challenging balancing acts. (Tod Beardsley) Flipboard Reddit Whatsapp Whatsapp Email","https:\u002F\u002Fwww.securityweek.com\u002Fcritical-paperclip-flaw-allowed-admin-access-code-execution\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F11\u002FNPM-code-software-development.jpeg","2026-08-06T11:09:11+00:00","2026-08-06T12:00:18.188315+00:00",8,[18,21,24],{"name":19,"type":20},"Paperclip","product",{"name":22,"type":23},"AI agents","technology",{"name":25,"type":26},"Oasis Security","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":27,"icon":29,"name":30,"slug":31},null,"Vulnerabilities","vulnerabilities",[33,38,43,45],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":39},{"id":40,"icon":29,"name":41,"slug":42},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":44},{"id":27,"icon":29,"name":30,"slug":31},{"category":46},{"id":47,"icon":29,"name":48,"slug":49},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",[51],{"type":52,"value":53,"context":54},"cve","CVE-2026-41679","Critical vulnerability allowing arbitrary code execution and admin access in Paperclip."]