Unsecured Paperclip Instances Exposing Live Dashboards via Google Search
A Reddit user reported accidentally accessing a live Paperclip dashboard while searching for an error related to their OpenClaw agent. After Googling the error and clicking the first result, they were immediately presented with someone's complete Paperclip interface without any authentication required.
What Was Exposed
The exposed dashboard contained:
- Full organizational chart
- Active issues and task assignments
- Agent conversations and configurations
- Business plans and marketing strategies
- Task history and potentially API keys
The user noted they could read through "all his marketing plan, his whole business model" and described the situation as "your entire org, your agent configs, your API keys, your task history — all of it is public."
Common Security Misconfigurations
According to the source, this exposure occurs when Paperclip instances have these characteristics:
- Exposed on a public domain or IP address
- Running in local_trusted mode
- Without Basic Auth or any login layer in front
The user emphasized that while Paperclip's self-hosted nature provides full control, it also means "you are responsible for securing it." They warned that improperly secured instances create "an accidental open-source intelligence feed of your entire company" that's indexable by search engines.
The core recommendation from the source is straightforward: "Don't expose it on a public domain without auth."
📖 Read the full source: r/openclaw
👀 See Also
Claude Code Security Plugin: Pushing AppSec into the Developer Workflow
Anthropic shipped a security-guidance plugin for Claude Code that identifies and fixes vulnerabilities during coding. Available to all users via the plugin marketplace, not just Enterprise. Discusses whether this becomes a lightweight assistant, serious AppSec layer, or bridge to Claude Security.
Frontier AI Has Broken Open CTF Competitions — GPT-5.5 One-Shots Insane Pwn Challenges
Claude Opus 4.5 and GPT-5.5 can solve medium-to-hard CTF challenges autonomously, turning scoreboards into a measure of orchestration and token budget rather than security skill.
Potential Claude Security Incident: Self-Sent Password Alerts and Suspicious .NET Process
A user reports receiving suspicious password reset alerts that appeared to be sent from their own account after logging into Claude, with emails vanishing minutes later and an unusual .NET process blocking system shutdown.
Cisco source code stolen via Trivy supply chain attack
Cisco's internal development environment was breached using stolen credentials from the Trivy supply chain attack, resulting in the theft of source code from over 300 GitHub repositories including AI-powered products and customer code.