Paperclip RCE Exposes How Agent Configuration Became Code Execution
Six API Calls to Total Compromise On August 5, 2026, researchers at Oasis Security disclosed CVE-2026-41679, a CVSS 10.0 unauthenticated remote code execution vulnerability in Paperclip, an open-source agent orchestration platform. The flaw lets an unauthenticated attacker gain full server control via six API calls against any Paperclip instance running in default authenticated mode. The…