MisuseSerious2 sourcesFirst seen 03/06/2026

Picture from the adnanthekhan.com article — Image: adnanthekhan.com

Cline's Issue Bot Took the Hint, Then Took the Publishing Keys

Ourtake

A bug report title was enough to make an AI run commands, and the npm publishing secrets were one shared cache away.

What happened

Cline ran AI issue triage with Claude Code, and a crafted issue title could make it execute commands via prompt injection. The attacker poisoned a GitHub Actions cache shared with the nightly release workflow to steal npm publishing secrets. An anonymous attacker then published cline@2.3.0, which was later retracted; it only added OpenClaw installation.

Sources

simonwillison.net · 03/06/2026Clinejection — Compromising Cline's Production Releases just by Prompting an Issue Triager (opens in a new tab)
adnanthekhan.com · 03/06/2026Clinejection — Compromising Cline's Production Releases just by Prompting an Issue Triager | Adnan Khan - Security Research (opens in a new tab)