The report
An October 30 advisory for Paperclip describes a delayed-execution boundary: a caller with an agent API key can change cleanupCommand or teardownCommand on an execution workspace, while the corresponding cleanup routine runs those commands later under the Paperclip server process. The stated affected range is 2026.403.0 up to, but not including, 2026.416.0. The advisory identifies a patch and assigns CVE-2026-119713. Read the advisory.
The noteworthy part is not merely that shell commands exist. Workspace cleanup is a privileged operation that can outlive the request that configured it. A restricted agent credential becomes a route to a future host-side effect because the service accepts executable cleanup configuration from that credential. Reviewers inspecting only the immediate PATCH response could miss the later command execution. The technical Case separates the attacker-controlled configuration, the archival trigger and the execution identity.
Why the later trigger matters
A successful configuration write does not by itself prove a command has executed. Execution depends on the subsequent workspace lifecycle operation; conversely, revoking the original key after storing a dangerous command may not erase the persisted command. Remediation must cover both which actors may set shell-bearing fields and which pending configurations still exist. The advisory does not establish a known production victim count.
An effective check compares the stored configuration and later cleanup receipt under a harmless command marker, verifies the exact agent-key privileges before and after the fixed version, and ensures that server-owned cleanup cannot inherit arbitrary tenant-controlled shell text.