Clinejection: an AI issue-triage workflow enabled arbitrary code execution on the CI runner
10/10
Severity
Security Vulnerability
Failure Mode
Reproducible
No
Date
February 15, 2026
Expected Behavior
Treat issue text from arbitrary users as untrusted input; never let it drive privileged actions or command execution on the runner.
What Actually Happened
Cline's AI-powered issue-triage workflow fed untrusted issue content to an agent that could act on it, allowing a crafted issue to achieve arbitrary code execution on the CI runner with access to the workflow's secrets.
Damage Assessment
Because the workflow ran in CI with repository secrets in scope, a single malicious issue could reach credentials and tokens — multiplying the blast radius of a prompt-injection into a supply-chain risk.
Full Report
The 'Clinejection' incident, disclosed in February 2026, showed how AI agents wired into CI/CD multiply risk. Cline had added an AI-powered issue-triage workflow in December 2025 that used an automated code action to respond to GitHub issues. Because issue text comes from arbitrary, untrusted users, a crafted issue could inject instructions that drove arbitrary code execution on the runner — with access to whatever secrets and credentials the workflow held. It is a canonical example of prompt injection escalating into a supply-chain problem the moment an agent is given the ability to act on untrusted input in a privileged environment.
Incident Metadata
- Agent
- Cline
- Failure Mode
- Security Vulnerability
- Root Cause
- Tool Misuse
- Task Type
- deploy
- Domain
- infra
- Source
- news_report