Paperclip AI: an agent import led to host command execution

A group of vulnerabilities in the Paperclip AI agent-orchestration platform showed that importing an “agent company” can be equivalent to installing software. The most serious chain, tracked as CVE-2026-41679 and GHSA-68qg-g8mg-6pr7, allowed an attacker to bypass import controls, supply a process-adapter configuration and execute a command on the server host.

The issue reaches beyond one endpoint. An agent bundle contains instructions, a workspace strategy, an execution adapter, file paths and lifecycle commands. If the platform trusts the imported package and passes those fields to a shell, the boundary between AI configuration and executable code disappears.

The technical chain

The Paperclip project advisory describes missing authorisation on a new-company import. A bundle could contain .paperclip.yaml defining an agent with a process adapter, command and arguments. When the agent started, the backend executed the declared process in the Paperclip service context.

Depending on deployment mode, an attacker could combine open registration with self-approval of a CLI key. Further advisories found the same pattern in cleanupCommand, provisionCommand, instruction-file paths and cross-tenant tokens. The RAXE Labs summary lists eleven GHSA identifiers covering eight underlying failure primitives.

Releases before 2026.416.0 required an urgent update. Patching does not change the architectural fact that a local adapter is an intentional process-execution facility. After compromise of an authorised configuration account, a legitimate feature may produce the same outcome.

Impact boundary

An agent process may see environment variables, model tokens, cloud keys, repositories and working data. RCE on the platform host can also alter other agents’ instructions, intercept results and persist outside conversation memory. In a multi-tenant deployment, missing companyId checks increase the risk of crossing customer boundaries.

Network-accessible installations, local_trusted mode, open registration and deployments that do not separate orchestration from execution carry the greatest exposure. An agent runtime should not share the control plane’s filesystem and secrets.

Securing an agent platform

1. Upgrade both paperclipai and @paperclipai/server to at least the fixed release and restart every process.
2. Disable open registration, remove unknown accounts, CLI keys and agents, and inspect the import history.
3. Rotate secrets available to the service process, including LLM, OAuth, cloud, email, database and repository credentials.
4. Run adapters in separate disposable sandboxes without host-environment inheritance and with network access denied by default.
5. Treat an import file like a container image: sign and scan it, approve its provenance and display a complete configuration diff before execution.
6. Replace arbitrary commands with declarative, versioned tools and allowlisted arguments.
7. Log the principal, tenant, import hash, child process, network activity and result of every lifecycle operation to an external system.

Separate the control plane from the data plane

The panel, metadata database and import-approval service belong to the control plane. The process executing agent code is the data plane and should be treated as an untrusted workload. A narrow protocol between them should define the tool type, resource limits and a single-use task token. The data plane must not be able to modify other agent definitions or retrieve the platform’s main encryption key.

In Kubernetes, this means a separate namespace, a service account without cluster API permissions, a read-only root filesystem, no hostPath and deny-by-default egress. In a virtual machine, the same principle calls for an ephemeral worker without a shared home directory. Logs must distinguish the command stored in an import from the process actually launched after argument interpretation; only the latter reveals unexpected shell expansion.

Facts and conclusions

The advisories confirm vulnerabilities and fixes; demonstrations took place in controlled environments. There is no public evidence that every Paperclip installation was attacked. Breachroad’s conclusion is to recognise agent imports as a full software-supply boundary.

An AI and LLM security audit must cover the orchestrator and runtime, not only prompts. Cybersecurity training helps teams recognise when “configuration” carries authority over code and data.