GHSA-w8hx-hqjv-vjcq: Paperclip: Malicious skills able to exfiltrate and destroy all user data

Summary

A malicious skill can make an agent call PATCH /api/projects/{projectId}/workspaces/{workspaceId} to set a malicious runtimeConfig, then call the runtime-services/start endpoint. The server runs the unsanitized command via spawn() in server/src/services/workspace-runtime.ts, letting an attacker execute shell commands on the server and expose its environment variables, including API keys, JWT secrets and database credentials.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• InfoAgentic AppSec: Software Development Went Agentic. Security Didn’t.Similar attack · Snyk Blog
• HighCVE-2026-76066: IntentKit authorization bypass lets callers execute owner-restricted toolsSimilar attack · NVD/CVE Database
• LowJev as a judge: How counterfeit policy steers JevSimilar attack · Datadog Security Labs
• LowAgents at the Edge: Extending AI Security Governance to Physical AI with DefenseClawSimilar attack · Cisco AI Blog
• InfoWhat You Sign Is Not What You Run: The Verifiability Gap in Quantized LLM Supply ChainsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)