Paperclip AI Flaws Let Attackers Run Host Commands via Malicious Agent Imports

Paperclip, an open-source control plane for AI agent teams, contains three security vulnerabilities that expose developers and organizations to remote code execution and data exposure attacks.

Two flaws allow attackers to execute arbitrary commands on network servers or developer machines by importing malicious agents and initiating them. The attack chain requires an attacker to craft a specially designed agent that, once imported into a Paperclip instance and started, executes system commands with the privileges of the running process. This represents a direct path to host compromise.

A third vulnerability exposes sensitive data and control-plane details through unprotected API routes. Attackers can access this information without authentication, potentially revealing configuration details, credentials, or operational data that could facilitate follow-up attacks.

The vulnerabilities affect teams using Paperclip to orchestrate multi-agent AI systems. Organizations running Paperclip in production environments face the highest risk, as successful exploitation grants attackers command-line access to their infrastructure. Development environments also face threats, as compromised developer machines could serve as entry points to broader networks.

The attack requires an attacker to either convince a user to import a malicious agent or, in some scenarios, to gain write access to agent repositories. This positions the vulnerabilities as moderately exploitable but with high impact once compromised.

Affected organizations should immediately review Paperclip deployments and restrict agent imports to trusted sources. Limiting API access through network controls and disabling unnecessary routes reduces exposure. Developers should update to patched versions when available and audit existing agent imports for suspicious activity.

The Paperclip security advisory recommends patching immediately. Until updates deploy, organizations should consider removing Paperclip from internet-facing environments and restricting access to trusted networks only.