STUPID-2026-0030
Clinejection: an AI issue-triage workflow enabled arbitrary code execution on the CI runner
Why 9/10
Anyone who could open an issue could reach Cline's publishing tokens, and someone did: an unauthorized Cline CLI was published to npm. Credentials were rotated and the package pulled, so the damage was contained, not undone.
- Scope
- 4/4
- Many organisations or the public: a flaw in a widely used product, mass exposure, a large outage
- Recoverability
- 2/3
- Partly lost, or loss reported without saying whether it was recovered
- Did it happen
- 2/2
- Happened in real use
- Beyond the user
- 1/1
- Production systems, customers or third parties, or credentials and sensitive personal data
The score is the sum of these four factors. How each factor is scored · scored 2026-10-29
Status and what to do
- Affected
- Cline's own GitHub repository CI from December 2025 to 9 February 2026, and anyone who installed the unauthorized Cline CLI release from npm.
- Fix status
- Fixed · Cline removed the AI triage workflows and stopped nightly jobs consuming the Actions cache in PR #9211, about 30 minutes after disclosure.
- Mitigation
- If you run an agent on issue or PR text in CI: treat that text as untrusted input, give the job no tools that execute code, and never share cache keys between that job and release jobs. Source
- Last reviewed
- 2026-10-29 · Report a correction to this record
Instruction given
Automatically triage incoming GitHub issues with an AI agent.
Expected behavior
Treat issue text from arbitrary users as untrusted input; never let it drive privileged actions or command execution on the runner.
Actual behavior
Cline's AI-powered issue-triage workflow fed untrusted issue content to an agent that could act on it, allowing a crafted issue to achieve arbitrary code execution on the CI runner with access to the workflow's secrets.
Damage
Through GitHub Actions cache poisoning, the triage workflow could reach the nightly release jobs' VS Code Marketplace, OpenVSX and npm publishing tokens. The researcher says he tested only on a mirror, but a different actor found that proof of concept, used it against Cline, obtained the publishing credentials and released an unauthorized Cline CLI to npm with a postinstall script that installed OpenClaw. Cline removed the AI workflows in PR #9211 about 30 minutes after public disclosure.
Full write-up
The 'Clinejection' incident, disclosed in February 2026, showed how AI agents wired into CI/CD multiply risk. Cline had added an AI-powered issue-triage workflow in December 2025 that used an automated code action to respond to GitHub issues. Because issue text comes from arbitrary, untrusted users, a crafted issue could inject instructions that drove arbitrary code execution on the runner — with access to whatever secrets and credentials the workflow held. It is a canonical example of prompt injection escalating into a supply-chain problem the moment an agent is given the ability to act on untrusted input in a privileged environment.
Classification
- Agent
- Cline
- Failure mode
- Security Vulnerability
- Root cause
- Tool Misuse
- Domain
- Infra
- OWASP Agentic Top 10 (our mapping)
- ASI01 Agent Goal Hijack · ASI04 Agentic Supply Chain Vulnerabilities · ASI05 Unexpected Code Execution (RCE) list
- MIT AI Risk Repository (our mapping)
- 2.2 AI system security vulnerabilities and attacks taxonomy
- Source
- Security Research
Related incidents
Cite this record
StupidLLM. "STUPID-2026-0030: Clinejection: an AI issue-triage workflow enabled arbitrary code execution on the CI runner." AI Agent Incident Database, 2026. https://www.stupidllm.com/incident/STUPID-2026-0030/ (accessed 2026-10-29). CC BY 4.0.
← STUPID-2026-0029By IDSTUPID-2026-0031 →
Get told when an agent breaks something
We document AI agent failures daily, severity-scored against a published scale. Each Monday, if any scored 7 or above that week — deleted data, leaked secrets, broken production — you get one email with the sources. When nothing did, you get nothing.
This database is callable over MCP — query it from inside your agent.