Paperclip's New Runner: What Changed—and What Still Needs Proof
Paperclip's November 6 update changes how AI coding agents run. We examine the official release, implementation pull requests and community issues, then explain what it means for nontechnical readers.
Start with the plain-English explanation ↓
Overview
On November 6, 2026, Paperclip published v2026.1106.0, promoting 515 commits from its beta line. The main change is operational: supported new Claude, Codex, OpenCode and Pi agents now start on the native Paperclip Runner by default. GitHub Copilot also becomes a native harness. Existing agents are not silently converted. [1]
This is a change in agent execution and governance—not the launch of a new foundation model. The same release adds repository-backed skills, optional model-based prompt-injection screening, observability and workspace recovery controls. The following analysis is based on the project's release and linked implementation work, not our own installation or benchmark. [1] [2] [3]
Technical Deep Dive
From legacy adapters to native Runner
A coding agent needs more than a language model: it needs a process that starts the model, passes instructions and tool permissions, tracks completion, and preserves the right workspace. Paperclip's Runner provides that execution boundary. [1]
New Claude agents use it on Apple Silicon, Intel macOS and Linux x64; Codex additionally supports Linux ARM64; OpenCode and Pi use it on macOS and Linux x64. Linux requires GNU libc 2.39 or newer. Windows parity is not promised in the release. [1]
Existing agents retain their runner; eligible Claude and Codex agents can choose a one-click upgrade, with incompatible settings disclosed. [1]
The release cites roughly 20% faster startup on simple Claude tasks after preloading essential task tools. The implementation PR identifies set_task_title, paperclip_finish and paperclip_block as the preloaded tools. This is a narrow project-reported measurement, not a claim that all agent tasks finish 20% faster or that answer quality improved. [1] [4]
Copilot becomes a native harness
Paperclip documents GitHub Copilot CLI 1.0.88 integration through Apps / AI Connections with a saved GitHub token. The available model list is discovered from the authenticated account. This unifies task boundaries with other native providers; it does not erase account limits or imply a free Copilot subscription. [1]
Project repositories can supply skills
Attaching a repository to a new project now imports its skills. The configured branch is checked about every five minutes using the setup person's GitHub connection. Updates can be paused and skills excluded; project access restrictions are inherited. [1] [2]
A running task pins the versions it started with, preventing a mid-run repository refresh from silently changing its instruction package. Existing projects can adopt sources manually. [1] [2]
This is convenient but creates a governance question: who can modify the tracked branch? A changed repository instruction can become agent context at the next refresh. Review permissions and pin trusted sources when appropriate; automatic import is not a code-security audit. [2]
Optional model-based tool-result screening
Administrators can configure an OpenRouter-backed classifier for suspicious tool results, with default model openai/gpt-oss-safeguard-20b. The implementation describes replacing a regex verdict with a valid model verdict, while retaining regex fallback when the model is unavailable. [1] [3]
The feature is off until configured. It may reduce false positives on ordinary code, but no classifier can guarantee that every malicious instruction is detected. [1] [3]
Breaking changes and recovery
The experimental Pipelines UI and related commands are removed; Cases and Routines remain. Agent run failures no longer reach Sentry by default. Operators who require that behavior must explicitly configure PAPERCLIP_SENTRY_RUN_FAILURES=unexpected or all. The heartbeat-run history endpoint now defaults to 200 records and caps responses at 1,000. Existing integrations should be checked before upgrading. [1]
Workspace cleanup can remove regenerable ignored build directories and optionally expire finished Paperclip-owned worktrees, with encrypted restore points for eligible uncommitted changes. That is recovery assistance, not a replacement for Git commits and backups. [1]
| Change | Documented behavior | Important limit |
|---|---|---|
| Native Runner | Default on qualified new agents [1] | Existing agents remain unchanged |
| Skills | Repository sync and version pinning [2] | Branch trust still matters |
| Security classifier | Opt-in model verdict [3] | Not a guarantee or default setting |
| Performance | Project reports ~20% simple-task startup improvement [4] | No independent cross-provider benchmark |
Community reports and remaining uncertainty
The GitHub tracker adds useful counterevidence, but a filed issue is not proof of widespread failure. Issue #19781 describes a controlled case where a released plugin Runner exited after completing one turn and the next turn was refused before reaching the provider. The reporter supplied reproduction steps and synthetic-provider results. [5]
The issue is currently closed; without verifying an exact fix and affected versions, closure alone should not be described as universal resolution. [5]
Another open issue warns that text passed between agents can be mistaken for trusted instructions, a potential prompt-injection route. This is a reported threat model, not evidence of a real-world compromise of v2026.1106.0. [6]
An October 30 open issue reports a timing race in model selection: the author observed 2 of 5 newly assigned issues starting without the plugin's selected model. Those numbers are the reporter's measurements, not ours. [6] [7]
No independent, broadly reproducible Runner-versus-legacy benchmark was identified for all supported providers. The project's roughly 20% figure is limited to simple Claude startup conditions. There are no reproduced screenshots in this article: the primary evidence is directly linked text, release notes and pull requests, and image rights have not been established. [1] [4]
Explained Simply
Imagine a company with several assistants who can write code. One uses Codex, another Claude, and another OpenCode. They all need someone to hand them tasks, decide what files they may touch, and notice when they finish. Paperclip is the coordinator; its Runner is the part that actually starts and supervises an assistant.
With the November 6 update, new assistants on supported computers automatically use the newer Runner. Existing assistants do not magically change. That is important if you already have a working setup: you can check compatibility and choose when to upgrade instead of having everything replaced unexpectedly. [1]
A skill is like an employee handbook: a reusable set of instructions that teaches the assistant how your project works. Paperclip can now fetch these handbooks from a GitHub repository and refresh them. That saves manual work, but you should trust whoever is allowed to edit the handbook. A bad instruction can still be bad even if it arrived automatically. [2]
The new security option is like hiring a guard to read suspicious notes before they reach the assistant. The guard is another AI model. It might notice a note that says “ignore the real task,” but it can also make mistakes. The guard is not enabled by default, and it does not make your system perfectly safe. [3]
What should you do? If you use Paperclip, read the migration notes, check your operating system, review who controls your repositories, back up important work, and try the upgrade with one low-risk agent first. If you do not use Paperclip, there is nothing to install or change. If you depend on the removed Pipelines experiment or automatic Sentry failure reporting, investigate those changes before updating. [1]
Conclusion
The strongest supported conclusion is that Paperclip v2026.1106.0 changes agent operations: a native Runner becomes the default on qualified systems, repository skills become easier to maintain, Copilot joins the harness list, and optional tool-result screening is available. The dated release and merged PRs establish what the project shipped. [1] [2] [3]
What remains unproven here is a broad independent speed advantage, universal security protection or bug-free operation in every environment. This is a source-based investigation, not a claim that Dekrov installed or benchmarked Paperclip. Keep human review, explicit permissions and real backups in the loop.
Evidence & Sources
Source type indicates provenance, not guaranteed accuracy. Links consulted November 10, 2026.
- OfficialPaperclip v2026.1106.0 official releaseNovember 6 release notes, scope and breaking changes
- OfficialRepository skills implementation, PR #16066Merged October 13; repository imports and version pinning
- OfficialPrompt-injection model classifier, PR #16976Merged October 20; opt-in classifier and fallback
- OfficialClaude tool preload, PR #16885Merged October 19; three essential tools preloaded
- CommunityRunner recovery issue #19781Filed November 7; reporter reproduction, issue now closed
- CommunityCross-agent handoff security concern #2755Opened April 4; open issue and proposed mitigations
- CommunityPer-run model routing race #18300Opened October 30; author-reported timing test