Overview
Paperclip is an open-source platform for managing and coordinating teams of AI agents. In practical terms, Paperclip is a Node.js server with a web UI that Let’s you create an AI “company” consisting of multiple agents (CEO, CTO, developers, researchers, marketers, etc.), assign goals, track work, enforce budgets, and review decisions
The vulnerability has a CVSS score of 10.0 and allows an unauthenticated attacker to take over a Paperclip server with only six API calls. The full chain is described in this GitHub advisory.
A Metasploit module was developed to automate the attack chain. At the time of the assessment, a Shodan search reported approximately 700 exposed Paperclip instances, indicating comparatively limited Internet exposure.
Remediation
Upgrade to 2026.410.0 or a later fixed release.
References
Credits
Discovery -> Sagi Layani