Application security , AI/ML Paperclip authorization bug exploited, leads to control plane takeover August 6, 2026 Share By Steve Zurier (Adobe Stock) A critical bug in the AI management platform Paperclip let an attacker exploit flaws in Paperclip’s authentication and authorization flow and then elevate that account’s privileges, import a malicious agent config, and finally achieve arbitrary code execution. Sagi Layani‏, the solutions architect at Oasis Research who led the team that found CVE-2026-41679 , noted that the 10.0 authorization bypass bug was serious because in practical terms, any affected Paperclip instance reachable by an attacker could be taken over. “Agent platforms are often connected to credentials and sensitive information, so compromising the control plane may give an attacker access to far more than the application itself,” said Layani. Eli Ainhorn, senior vulnerability researcher at Noma Labs, explained that whether it’s Paperclip, OpenClaw , RufRoot, or GitLost , we're seeing the exact same failure across the AI landscape: developer tools default to dangerous network permissions and treat untrusted inputs as safe instructions, handing remote attackers immediate control over local workstations, underlying servers, and enterprise data. Ainhorn said the security issues Oasis uncovered in Paperclip and OpenClaw mirror findings over the last month from Noma Labs in vulnerabilities like RufRoot and GitLost . Ainhorn said across all four cases, AI orchestration tools concentrate extreme privilege such as system shell access, persistent memory storage, API keys, and private codebase access behind weak or missing trust boundaries. “Attackers no longer need complex exploits to breach these platforms,” said Ainhorn. “Instead, they leverage basic design flaws, including unauthenticated local endpoints, unthrottled loopback interfaces, or untrusted external inputs like public issue tickets to manipulate how the agent operates.” Denis Calderone, chief technology officer at Suzu Labs, added that Paperclip orchestrates AI agents and manages their credentials, execution, and access to host resources. The process adapter was designed to let agents execute system commands with full OS privileges, which means the authorization checks in front of it are the only thing between an outsider and arbitrary code execution on a server,” said Calderone. “When one of those checks is missing, the whole chain collapses,” said Calderone. Calderone said of the other two bugs the Oasis team found, teams should fix the DNS rebinding bug: it carries a CVSS 9.6 and for good reason. Paperclip's local development mode binds to loopback and treats every request hitting that address as an implicit instance administrator. Calderone said the assumption is that only trusted local software can reach 127.0.0.1, but browsers can. An attacker-controlled webpage uses DNS rebinding to redirect requests to loopback while keeping same-origin intact, and suddenly Paperclip accepts attacker requests as administrator actions. From there the attacker imports a malicious agent configuration and executes commands on the developer's machine. “Think about what developers running these platforms locally have access to,” said Calderone. “Source repositories, API keys, cloud credentials, SSH keys. Code execution on that workstation through an AI orchestration platform is a straight path to a supply chain compromise. If your teams are running Paperclip or any similar AI agent platform locally, make sure local dev mode requires explicit authentication and validates hostnames rather than trusting everything on loopback.” Calderone added that the third finding, missing authorization on several API routes, exposed agent health data and documentation. “Worth patching, but not in the same class as the other two,” noted Calderone. Steve Zurier Related Black Hat Google’s John Hultquist on outpacing the adversary with AI threat defense SC Staff August 6, 2026 John Hultquist discusses Google’s approach to combating today’s threats. Black Hat Apiiro’s Idan Plotnik on AI writing code that sharpens attacks SC Staff August 6, 2026 Apiiro's Idan Plotnik makes the case for a prevention-first model. Black Hat Kai’s Galina Antova on the shift to machine-led security SC Staff August 6, 2026 Kai's Galina Antova discusses why the industry is moving toward machine-led security. Related Events Cybercast Bridging the Gap from CISO-Developed Tools to Black Hat Hype: What AI Security Leaders Should Watch Next On-Demand Event Cybercast Protecting Application User Data for Better Privacy, Governance, and Compliance On-Demand Event Cybercast The Next Evolution of Application Security: AI- Accelerated DevSecOps On-Demand Event Get daily email updates SC Media's daily must-read of the most current and pressing daily news Business Email By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy . Subscribe Related Terms Banner Browser Cache Cramming Common Gateway Interface (CGI) Client Cookie DLL Injection Dynamic Link Library You can skip this ad in 5 seconds