Finding / paperclip
2026-09-21-paperclip-v2026-831-0-bad-agent-bearer-tokens-401-instead-of-silently-becoming-the-local-user
v2026.831.0: bad agent bearer tokens 401 instead of silently becoming the local user. Per the release body, a bearer token that failed verification (expired, terminated agent, wrong company) used to fall through to the anonymous local-user actor; it now returns 401 naming the cause.
Channel: tagged-release. Half: defect (closed). Date: 2026-09-02.
Operator consequence: On v2026.824.x and earlier, an expired or wrong-company agent token could act as the local user rather than fail. Upgrade, then watch for new 401s: any integration that starts failing was relying on the fall-through. Treat pre-831.0 audit attribution of “local user” actions as possibly agent-originated.
Receipt
Finding metadata
Run: 2026-09-21-weekly-digest-2026-08-20_2026-09-21-frontier-v0
Finding ID: 2026-09-21-paperclip-v2026-831-0-bad-agent-bearer-tokens-401-instead-of-silently-becoming-the-local-user
Profile citations
- Paperclip / claim / bad-bearer-token-401
Source links
Primary links, including exact changelog lines when available.