How to Lock Down Paperclip Before Your AI Agents Touch Real Work

Implicator PRO Briefing / 29 Sep 2026

Paperclip organizes AI agents into a working team. Our trial found useful controls alongside defaults that let agents hire colleagues, skip permission prompts and inherit the host’s environment.

Chuck Keith had an improbable connection fault at his studio: when someone flushed the toilet, staff lost their connection to the storage system. In a video published September 24, the IT educator assembled an agent “IT department” to investigate. A Claude Code agent named Dumbledore served as CEO, with Ron as CTO above network, storage and other specialists. They inspected switches, assigned tasks and traced a cluster of failing links. Keith gave a newly hired agent called Filch access to a security service through Paperclip’s secrets screen. Soon, Filch was assigning work that Keith had never requested. “Okay, I didn't ask for this, but Filch found stuff and he's got Ron doing some forced password resets on things,” Keith said. Moments later he added: “I don't think Ron has the ability to do that.”

The telling action was Keith’s own. He intervened.

Paperclip offers a way to direct and oversee a team of AI agents from one place. Implicator tested its controls on September 28, 2026, using stand-in agents that could exercise the software without calling an AI model.

Keith showed the pause control to his viewers: “So, like you don't need to do this. Pause it.” He had reason to keep the team running. After a long investigation, the agents identified a batch of third-party optical transceivers associated with the failing network links. Their diagnosis sent Keith to the transceivers, though he was not ready to abandon his toilet theory. The same arrangement that helped investigate the fault had also allowed one agent to set another to handle password resets.

Those controls matter most on a company account, a developer’s laptop or any server that holds keys. In our test, the owner’s own powers held. But a run that Paperclip classified as Claude subscription use reported $5.00 and counted as zero against a $1.00 cap, Claude Code agents started with their permission prompts switched off, and a newly created agent could hire another agent until the owner changed a setting.

What Paperclip does

Paperclip is free, MIT-licensed software that you install and operate yourself. It does not contain an AI model. You bring agents that already handle jobs for you, such as Claude Code, Codex, OpenClaw, Hermes or Cursor. Paperclip assigns them roles and coordinates their tasks. The human owner sits above the organization as “the board.”

A team can have a CEO agent with other agents reporting to it. Tasks carry assignments and comments. Scheduled check-ins, called “heartbeats,” wake agents to look for assignments. Routines handle recurring jobs. The interface also offers cost limits, approvals and an activity log so an owner can see what ran and intervene. An agent’s ability to answer an assignment still comes from its own model, tools and access. Paperclip supplies the management layer around them. Keith says his agents hold a stand-up every day, a routine in which each reports what it did and asks the others about anything unclear.

The appeal becomes clearer in Keith’s network investigation. His agents divided the investigation, logged into switches, compared switch and storage records, and brought their findings back through the task system. The final report identified a batch of third-party SFP transceivers. An SFP is the small removable module that connects a switch to a fiber link. Keith replaced modules from the suspect batch with MikroTik-branded ones. His video did not establish that the replacements permanently fixed the fault; he said he would let the system run for a week or two before making that call.

The project’s reach grew quickly. Its GitHub repository was created on March 2, 2026. On September 28, it had 92,720 stars and 5,989 open issues. Stars indicate interest, not installations or successful deployments. The issue count is a backlog at that date, not a count of security defects. The software can be self-hosted without a Paperclip account, though operating it still requires a machine, an agent runtime and the keys that runtime needs for its assigned jobs.

The pseudonymous co-founder Dotta describes two problems facing agent teams: “Quality and governance permissions. Those are the two biggest things.” He wants owners to decide which agents may search, forward or reply to email and to see a record of their tool calls. Paperclip’s organization gives an owner places to express those decisions. Keith’s unexpected password-reset task shows why the details of enforcement deserve attention. His agents could coordinate through the interface, but he still had to judge whether their next proposed action belonged in the assignment.

The rest of this briefing reports what the current release did in our test and gives operators a checklist for checking their own installation.

Pro Members Only Paperclip promises that the human owner stays in charge of a team of AI agents. We installed the current release and tested that promise with stand-in agents. The PRO briefing reports what happened to budgets, permission prompts, hiring, secrets and pausing, with screenshots from our test, walks through the project’s security record, and ends with an 11-step pre-flight checklist: the shipped default, the change and how to check it. Our test used no live AI model and did not cover Linux sandboxing or authenticated mode; the briefing says where those limits apply. PRO includes a new deep dive every Tuesday. View PRO plans, $8 monthly or $89 annually.