Unsecured Paperclip Instances Exposing Live Dashboards via Google Search
A Reddit user reported accidentally accessing a live Paperclip dashboard while searching for an error related to their OpenClaw agent. After Googling the error and clicking the first result, they were immediately presented with someone's complete Paperclip interface without any authentication required.
What Was Exposed
The exposed dashboard contained:
- Full organizational chart
- Active issues and task assignments
- Agent conversations and configurations
- Business plans and marketing strategies
- Task history and potentially API keys
The user noted they could read through "all his marketing plan, his whole business model" and described the situation as "your entire org, your agent configs, your API keys, your task history — all of it is public."
Common Security Misconfigurations
According to the source, this exposure occurs when Paperclip instances have these characteristics:
- Exposed on a public domain or IP address
- Running in local_trusted mode
- Without Basic Auth or any login layer in front
The user emphasized that while Paperclip's self-hosted nature provides full control, it also means "you are responsible for securing it." They warned that improperly secured instances create "an accidental open-source intelligence feed of your entire company" that's indexable by search engines.
The core recommendation from the source is straightforward: "Don't expose it on a public domain without auth."
📖 Read the full source: r/openclaw
👀 See Also
AI Is Breaking the Two Vulnerability Cultures: Coordinated Disclosure vs. Linux's "Bugs Are Bugs"
Jeff Kaufman analyzes how AI vulnerability discovery is fracturing both coordinated disclosure and Linux's quiet-fix culture, using the recent Copy Fail (ESP) vulnerability as a case study.
VulnHunter: Capital One's Agentic AI Code Security Tool Now Open Source
Capital One open-sourced VulnHunter, an agentic AI tool that simulates attacker entry points, falsifies findings to cut false positives, and generates targeted code fixes.
How AI Text Watermarking Works: Secret Keys, Green/Red Word Choices, and Detection
Text watermarking hides marks in word choices, not characters. A secret key tilts word selection toward green, and detection counts green words to spot AI-generated text.
Claude Code Security Plugin: Pushing AppSec into the Developer Workflow
Anthropic shipped a security-guidance plugin for Claude Code that identifies and fixes vulnerabilities during coding. Available to all users via the plugin marketplace, not just Enterprise. Discusses whether this becomes a lightweight assistant, serious AppSec layer, or bridge to Claude Security.