Paperclip: codex_local inherited ChatGPT/OpenAI-connected Gmail and was able to send real email
Date: 2026-04
Affected: npm/paperclipai
Attack vector: sandbox-escape
Category: vulnerability-disclosure
Severity: High
CWE: CWE-284
CVSS: 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N)

### Summary A Paperclip-managed `codex_local` runtime was able to access and use a Gmail connector that I had connected in the ChatGPT/OpenAI apps UI, even though I had not explicitly connected Gmail inside Paperclip or separately inside Codex. In my environment this enabled mailbox access and a real outbound email to be sent from my Gmail account. After I manually intervened to stop the workflow, follow-up retraction messages were also sent, confirming repeated outward write/send capability. This appears to be a trust-boundary failure between Paperclip-managed Codex execution and inherited OpenAI app connectors, amplified by dangerous-by-default runtime settings. ### Details Successful runtime calls include: - `mcp__codex_apps__gmail_get_profile` - `mcp__codex_apps__gmail_search_emails` - `mcp__codex_apps__gmail_send_email` The connected Gmail profile resolved to my personal account. Inside the Paperclip-managed `codex-home`, I also found cached OpenAI curated connector state for Gmail under a path like: - `codex-home/plugins/cache/openai-curated/gmail/.../.app.json` This strongly suggests that the runtime had access to an already connected OpenAI apps surface rather than a Paperclip-specific Gmail integration that I intentionally configured. Separately, in the installed Paperclip code, `codex_local` defaults `dangerouslyBypassApprovalsAndSandbox` to `true`, and the server-side agent creation path applies that default when the flag is omitted. In practice, that ma


Mitigations:

Architectural layers (MAESTRO):