Executive Summary
A critical Paperclip flaw let an attacker self-register, sign in for board-level API access and import a new company for code execution.
What Happened
An attacker could self-register, sign in for board-level API access, and import a new company for code execution. The post Critical Paperclip Flaw Allowed Admin Access, Code Execution appeared first on SecurityWeek .
Affected Products
- Paperclip
Vulnerability / Attack Technique
Self-registration to privileged API access and code execution
Technical Mechanism
Open registration granted board-level API access, and importing a company triggered code execution.
AI Security Category
LLM03:2025 Supply Chain
Part of the AI Supply Chain and AI SBOM topic.
Relevant Frameworks
RealGround Analysis
Paperclip is a control plane for AI agent teams, so its compromise controls the agents. RealGround analysis: agent control planes need closed registration and strict API authorization.
Recommended Controls
- Update Paperclip
- Disable open registration
- Restrict board-level API access
Related RealGround Service
AI Agent Business Logic Audit · or start with the free AI Agent Security Scanner.
Sources
securityweek.com: https://www.securityweek.com/critical-paperclip-flaw-allowed-admin-access-code-execution/
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.