Maximum Severity RCE Vulnerability Decimating Paperclip AI Instances

Paperclip, a Node.js/React platform for managing AI agent teams, contains a critical CVSS 10 vulnerability that enables unauthenticated remote code execution by chaining four default-open flaws (open signup, disabled email verification, self-approval of API keys, and an import endpoint authorization bypass). The advisory warns internet-exposed instances running default/authenticated mode can be fully compromised in six API calls and recommends upgrading to v2026.410.0+, disabling public signup, enabling email verification, and adding instance-admin checks to /import and /import/preview.