A significant security flaw in Paperclip, an AI management platform, has been identified by Oasis Security. This flaw allowed unauthorized remote attackers to execute arbitrary code with server permissions. Paperclip is utilized by organizations to manage autonomous AI agents and supports importing companies and commands via YAML files. The vulnerability, tracked as CVE-2026-41679 with a maximum CVSS score of 10, impacted network-accessible Paperclip instances configured in default authenticated mode. The core of the issue was a missing authorization check that permitted attackers to register accounts without email verification, create command-line interface (CLI) challenges, and subsequently deploy agents by importing a new company. Attackers could gain a board API token tied to their account, granting them access to company import routes without requiring administrator privileges. This flaw allowed attackers to import companies using crafted .paperclip.yaml files, which could execute commands at the host level as the Paperclip server process. The exploitation potentially exposed application data, source repositories, and sensitive credentials. Paperclip has addressed this security defect by implementing authorization checks and refining company scoping. Additionally, Oasis Security discovered two other vulnerabilities: one involving missing authorization on API routes leading to data exposure, and another related to DNS rebinding on loopback weaknesses that could enable code execution on development machines. These issues highlighted the need for robust security measures in AI management platforms, as AI agents represent a new dimension of enterprise identity, often operating with distributed workflows and multiple credentials.