Paperclip Tops 80,000 Stars, Five Months After a Perfect 10

Paperclip was the most-starred repository on GitHub on Sept. 25, 2026, gaining 1,853 stars in a single day and pushing its total past 83,926, according to the project's own GitHub API record. That growth is happening five months after a maximum-severity, unauthenticated remote-code-execution flaw was found in the same software, patched in a single release the week it was reported.

Paperclip, built by Paperclip Labs Inc. and released under the MIT license, describes itself in its own README as software for coordinating teams of AI agents, from OpenAI, Anthropic and other providers, as an organization: an org chart with roles and reporting lines, budget caps that hard-stop overspending, approval workflows, and audit logs for what each agent did. The repository was created March 2, 2026. Its latest tagged release, v2026.916.1, shipped Sept. 21, one of three releases in September alone, alongside v2026.916.0 on Sept. 16 and v2026.831.1 on Sept. 2.

The growth is real by GitHub's own count: 83,926 stars, 15,168 forks, and 5,658 open issues as of Sept. 25. A trending repository is not the same as a trusted one, and Paperclip's security record supplies a specific reason to draw that distinction rather than assume it.

GitHub's security advisory database lists eight advisories against Paperclip, all published between April 10 and April 16, 2026, and all patched in a single release, version 2026.416.0. The most severe, CVE-2026-41679, carries a CVSS score of 10.0, the maximum on the scale, a rating reserved for flaws that need no authentication and no user interaction to fully compromise a system. GitHub's own advisory record describes the chain: an attacker exploits Paperclip's open account registration, self-approves a CLI credential, exploits a missing authorization check on Paperclip's company-import feature to reach board-level access, then imports a malicious agent configured with a process adapter, a feature meant to let an agent run shell commands, to execute code with the same privileges as the Paperclip process itself. The advisory says the attack takes six API calls and no user interaction. It credits the finding to Sagi Layani, a solutions architect at the security firm Oasis Security.

The other seven advisories, also patched in 2026.416.0, include two more rated critical: a cross-tenant API key flaw that GitHub says "allows full victim-company compromise," and a token-minting bug that let one paying customer's account mint API credentials for another's. A lower-severity issue, rated 4.3, let any user spoof who had approved a pending action by editing a client-controlled field.

1. Unauthenticated RCE via import bypass10 CVSS score (of 10)
2. Cross-tenant API key IDOR9.9 CVSS score (of 10)
3. Cross-tenant token minting bypass9.9 CVSS score (of 10)
4. OS command injection in cleanup step9.8 CVSS score (of 10)
5. Gmail connector sandbox bypass8.7 CVSS score (of 10)
6. Unauthenticated endpoint exposure8.3 CVSS score (of 10)
7. Stored XSS via markdown body5.4 CVSS score (of 10)
8. Approval spoofing via client field4.3 CVSS score (of 10)

Source: GitHub Security Advisory Database for paperclipai/paperclip, accessed 2026-09-25

Oasis Security did not publish its own account of the research until Aug. 5, 2026, nearly four months after the advisories and the patch, meaning most public awareness of the flaw chain arrived well after Paperclip had already fixed it.

The 5,658 open issues are not all security reports. Paperclip's own tracker also documents plain operational failures, including issue No. 4060, titled "CRITICAL: Fix UUID validation for checkout endpoint (40+ hour outage)," which describes a checkout bug that caused what the report calls a multi-hour revenue loss before a fix shipped. That is the ordinary texture of a project people actually run against paying customers, not a red flag by itself, but it is also detail a reader only finds by opening the tracker, since neither the star count nor GitHub's trending badge distinguishes a feature request from an outage report.

That timing cuts against the more alarming reading. Every one of the eight advisories was closed in the same release, shipped inside the same week the earliest of them was reported, and GitHub's database shows no advisory filed against Paperclip since April. A project that bundles eight fixes, including a maximum-severity one, into a single coordinated release and then keeps shipping roughly weekly is not the profile of an abandoned or careless one. Anyone still running a Paperclip instance built before version 2026.416.0, however, is running software with a documented path to full compromise from an unauthenticated network position.

What the star count and the open-issue count do not resolve is how many of Paperclip's deployments are actual production use. GitHub does not publish install or deployment figures, and The Terminal has previously found gaps between a project's GitHub trending numbers and what its own data actually supports. Paperclip Labs has not published a transparency report or said how many organizations run the software against real infrastructure rather than a demo. If a ninth advisory surfaces against a current release, or if Paperclip Labs discloses real deployment numbers that look small next to 83,926 stars, that would be the concrete signal that today's trending run is closer to attention than adoption. Nothing in GitHub's own record yet says which one it is.

The pattern is not unique to Paperclip. Snyk's researchers found malware distributed through a different agent-tooling project that had passed 650,000 stars, and this site's own reporting has repeatedly found that a large star count answers a question about attention, not about whether the software underneath is safe to run with real credentials attached. Paperclip's own credentials problem was real and was fixed fast; it is not the flaw driving today's 1,853-star jump, since that fix is five months old. What is driving it is a question GitHub's public data cannot answer on its own.