The reported request accepted an agent credential that should not grant unrestricted server command authority. A PATCH to execution-workspace configuration could store shell content that was later run during archive or teardown under the server account. A valid agent key and a subsequent lifecycle transition were necessary; the report is not evidence of…
Inspect the ClaimsCase · DiggingBeagle record
Paperclip agent-key request could turn a later workspace cleanup into shell execution
An unreviewed advisory describes an agent-key authority crossing when updating a workspace cleanup command that the server executes later.
Scope
The advisory is unreviewed and does not document exploitation of a production tenant.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade D
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
The pinned Claim and its primary disclosure support the described controlled result, but do not establish a population-wide rate or calibrated impact. The only available supporting evidence is the reporter's or advisory author's own account; independent reproduction has not been shown. Impact remains unbanded because no calibrated impact rubric for this particular evidence is established.
Assessed Nov 2, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-2026-NOV02-PAPERCLIP-DEFERRED-SHELL-A · GitHub Advisory GHSA-832j-x75x-r6jc, Paperclip cleanup command injection
At a glance
Deferred execution is still a privileged action. Authorization must cover the eventual effect rather than just the request method.
Read the implicationsThe advisory is unreviewed and does not document exploitation of a production tenant. The population of agent keys able to mutate cleanup commands and the number of actual hosts exposed are not established.
Limits and uncertaintyFull account
The reported request accepted an agent credential that should not grant unrestricted server command authority. A PATCH to execution-workspace configuration could store shell content that was later run during archive or teardown under the server account. A valid agent key and a subsequent lifecycle transition were necessary; the report is not evidence of anonymous exposure or compromise in the field. The advisory lists 2026.416.0 as the repair version.
The advisory identifies a time-shifted command boundary. A caller holding an agent API key can update workspace cleanup and teardown strings; later, an archive operation causes the Paperclip server to execute those strings with its own operating-system privileges. That makes the later process, not the mutation request, the decisive side effect. The affected release range is reported as 2026.403.0 through versions before 2026.416.0, which has a referenced fix. The advisory is marked unreviewed and is not evidence that malicious commands ran on production customer hosts.
Mechanism and trust boundary
- 01
Submit authorized agent API key
The request is authenticated to an agent rather than a privileged workspace administrator.
Boundary: Agent identity into workspace configuration
- 02
Write deferred shell content
The agent updates cleanup or teardown command fields through the workspace endpoint.
Boundary: Configuration edit into future executable code
- 03
Archive the workspace
Cleanup executes the stored command with the server account capabilities.
Boundary: Workspace lifecycle into host shell
Claims & evidence
CLM-2026-NOV02-PAPERCLIP-DEFERRED-SHELL-AGHSA-832j-x75x-r6jc reports that a valid Paperclip agent API key could write cleanupCommand or teardownCommand in versions 2026.403.0 before 2026.416.0, leading to command execution when the workspace was archived.supported
Basis: reported finding
- supportsGitHub Advisory GHSA-832j-x75x-r6jc, Paperclip cleanup command injectionprimary disclosure
GitHub advisory, Description, Affected versions and Fixed versions
CLM-2026-NOV02-PAPERCLIP-DEFERRED-SHELL-BThe October 30 Paperclip advisory describes an agent-key holder setting cleanupCommand and teardownCommand, which are later executed by the server process when the workspace is archived; version 2026.416.0 is referenced as a fix.supported
Basis: reported finding
- supportsGitHub Advisory GHSA-832j-x75x-r6jc, Paperclip cleanup command injectionprimary disclosure
GHSA-832j-x75x-r6jc, Description and References to v2026.416.0
Implications
Deferred execution is still a privileged action. Authorization must cover the eventual effect rather than just the request method.
Controls and mitigations
- Upgrade to 2026.416.0 or later, deny agent-key writes to executable lifecycle fields and audit preexisting stored cleanup commands.
- Upgrade to the reported fixed release and deny agent-token authority to alter executable cleanup or teardown commands; bind allowed cleanup actions to immutable server-owned definitions.
Unknowns and contradictions
- The advisory is unreviewed and does not document exploitation of a production tenant.
- The population of agent keys able to mutate cleanup commands and the number of actual hosts exposed are not established.
Sources and citation
Material revision history
- Nov 2, 2026 · Canonical change recorded · new in release · revision 214