What happened
Paperclip trusts agent-supplied cleanupCommand/teardownCommand without validation and executes them when archiving a workspace, so a holder of an agent API key — including a potentially prompt-injected agent — can achieve remote code execution on the host.
Why it matters
Agent execution platforms let agents drive host operations. Allowing agent-controlled commands to run at archive time means a prompt-injected or compromised agent turns its own cleanup path into a code-execution primitive against the infrastructure that is supposed to contain it.
Attack vector
An agent API key holder sets cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id; when the workspace is archived, cleanupExecutionWorkspaceArtifacts runs those commands through a shell on the host.
Affected systems
Paperclip 2026.403.0 before 2026.416.0; vulnerable endpoint PATCH /api/execution-workspaces/:id.
Mitigation
Upgrade to Paperclip 2026.416.0 or later; restrict agent API keys to least-privilege and review the workspace-archive path for untrusted command strings.