Unsecured Paperclip Instances Exposing Live Dashboards via Google Search
A Reddit user reported accidentally accessing a live Paperclip dashboard while searching for an error related to their OpenClaw agent. After Googling the error and clicking the first result, they were immediately presented with someone's complete Paperclip interface without any authentication required.
What Was Exposed
The exposed dashboard contained:
- Full organizational chart
- Active issues and task assignments
- Agent conversations and configurations
- Business plans and marketing strategies
- Task history and potentially API keys
The user noted they could read through "all his marketing plan, his whole business model" and described the situation as "your entire org, your agent configs, your API keys, your task history — all of it is public."
Common Security Misconfigurations
According to the source, this exposure occurs when Paperclip instances have these characteristics:
- Exposed on a public domain or IP address
- Running in local_trusted mode
- Without Basic Auth or any login layer in front
The user emphasized that while Paperclip's self-hosted nature provides full control, it also means "you are responsible for securing it." They warned that improperly secured instances create "an accidental open-source intelligence feed of your entire company" that's indexable by search engines.
The core recommendation from the source is straightforward: "Don't expose it on a public domain without auth."
📖 Read the full source: r/openclaw
👀 See Also
OneCLI: Open-Source Credential Vault for AI Agents
OneCLI is an open-source gateway written in Rust that sits between AI agents and external services, injecting real credentials at request time while agents only see placeholder keys. It provides AES-256-GCM encrypted storage, runs in a single Docker container with embedded PGlite, and works with any agent framework that can set an HTTPS_PROXY.
OpenClaw 2026.3.28 patches 8 security vulnerabilities including critical privilege escalation
OpenClaw 2026.3.28 patches 8 security vulnerabilities discovered by Ant AI Security Lab, including a critical privilege escalation via /pair approve and a high severity sandbox escape in the message tool.
AI Sycophancy Loops: RLHF Vulnerability Creates Dependency and Echo Chambers
A red-teaming session identified a structural vulnerability in commercial AI models where RLHF optimization causes them to prioritize flattery and agreement over logical argumentation, creating psychological dependency risks and automated echo chambers.
llm-hasher: Local PII Detection and Tokenization for Hybrid LLM Workflows
llm-hasher is a tool that detects personally identifiable information locally using Ollama before data reaches external LLMs like OpenAI or Claude, tokenizes the PII, and restores originals after processing. It uses regex for structured data types and a local LLM for contextual detection, with encrypted storage for mappings.