Paperclip Fixed a 10.0 Flaw, Then Leaked API Keys Again

Paperclip, an open-source platform for running teams of AI agents that has passed 86,000 stars on GitHub, patched a security bug on Sept. 16 that let any caller, including an agent itself, read back its own plaintext credentials through the agent API.

The fix, described in the project's own Sept. 16 release notes for version 2026.916.0, closes a gap in which every endpoint that returns agent details echoed stored API keys and tokens "as stored," so a plain credential bound to an agent "came back verbatim to any caller able to read the agent, including the agent itself via GET /api/agents/me." The release notes credit contributor glovario for the patch and call the exposure "the leak" outright in the changelog's own words.

The credential leak joins a dozen formal advisories since April

Beyond the changelog fix, GitHub's security advisory database lists 12 published advisories against the paperclipai/paperclip repository, 9 of them rated high or critical severity. Ten were published April 16, one on April 10 and one more on July 22. The most severe, tracked as CVE-2026-41679 and rated 10.0 out of 10 on the CVSS scale, let an attacker self-register an account, mint a board-level API key with no email verification, then import a company containing an agent configured with Paperclip's built-in "process adapter" to run arbitrary commands with the server's own privileges.

Oasis Security found a chain that needed no valid account

Security firm Oasis Security disclosed the CVE-2026-41679 chain and two related flaws on Aug. 5, after responsible disclosure to Paperclip ahead of publication. A second flaw the firm found, rated 8.3, exposed heartbeat data, agent documentation and deployment health information through routes with no access control. A third, rated 9.6, used DNS rebinding to defeat the loopback boundary Paperclip's local development mode relies on, letting an attacker's webpage run commands on a developer's own machine. Paperclip shipped fixes for the authenticated-mode flaws in version 2026.416.0 and the rebinding flaw in version 0.3.1, Infosecurity Magazine reported.

The cross-tenant flaw came from a missing check, twice

GitHub's advisory for the cross-tenant key-minting flaw shows three agent-key endpoints that checked only whether a caller was any authenticated board user, never whether that user belonged to the company owning the target agent, letting an attacker mint a working credential for a company they had never joined. A second, nearly identical advisory filed the same day, GHSA-3xx2, describes the same bug class in the same route. A separate high-severity advisory found a Paperclip-managed Codex runtime could inherit a user's Gmail connection from the unrelated ChatGPT apps interface and send real email from that account, producing an outbound message and a follow-up retraction during testing, the reporter said.

Flaw	Severity	Disclosed
Unauthenticated RCE via import (CVE-2026-41679)	10.0 critical	Aug. 5, 2026
Cross-tenant API key minting	9.9 critical	April 16, 2026
OS command injection via workspace cleanup	9.8 critical	April 16, 2026
DNS rebinding to local instances	9.6 critical	July 22, 2026
Plaintext credentials returned to any caller	Not scored	Sept. 16, 2026

The pattern is trust boundaries, not one bad line of code

Keeper Security chief executive Darren Guccione, commenting on the Oasis Security findings, called the pattern "a systemic failure in how AI agent control planes handle identity boundaries," rather than an isolated bug. Paperclip's own Sept. 16 release notes describe a related design change in the same spirit: a setting called dangerouslyBypassApprovalsAndSandbox, which some agent types had defaulted to true, is being pulled back in favor of narrower per-provider defaults, and self-hosted installs now get a native execution engine turned on by default that cloud-managed instances keep off.

What 86,000 stars do not tell a deploying team

Paperclip's own description calls it "the open-source app everyone uses to manage agents at work," and it has grown from its March 2 repository creation to more than 86,000 stars and over 5,700 open issues. None of that figure describes whether an installation is running a patched version, and unlike Nvidia's move to the open-source Vault fork OpenBao, where the appeal was a stable, single-purpose secrets store, Paperclip's own changelogs show a project still rewriting core authentication and credential-handling paths every few weeks. The project connects to OpenClaw, Claude Code, Codex and Cursor as backends, at a time when GitHub itself has spent months tightening what Copilot's own coding agents are allowed to touch, so a flaw in Paperclip's access checks reaches every credential those backends are configured to use.

Paperclip has not published a consolidated list of which fixes require an admin to change a default setting versus which apply automatically on upgrade.