Critical Paperclip AI Agent Flaws Allow Unauthenticated Remote Code Execution

Paperclip, an open-source AI agent orchestration platform, contained multiple high- and critical-severity vulnerabilities—most notably CVE-2026-41679 (CVSS 10.0) enabling unauthenticated registration to gain persistent API credentials and execute arbitrary OS commands via a process adapter, and a DNS rebinding flaw (CVSS 9.6) that allows code execution on developers' local machines. The report details impacts (data and credential theft, secret exposure, lateral movement), vendor fixes in newer releases, and recommended mitigations such as upgrading, restricting network exposure, and tightening import/authorization controls.