STUPID-2026-0072

Cline's execute_command reported a failing Ruff lint check as passing over Remote-SSH

3.0low
July 30, 2026Source checkedRepro reported

Why 3/10

A failing lint check was reported as passing; no data loss.

Scope
1/4
A few files, one session, one credential, or a small cost
Recoverability
0/3
Nothing was lost
Did it happen
2/2
Happened in real use
Beyond the user
0/1
Only the user's own non-production work

The score is the sum of these four factors. How each factor is scored · scored 2026-10-29

  1. Instruction given

    Run the project's Ruff lint check via execute_command and report whether it passed.

  2. Expected behavior

    Capture the actual stdout, stderr, and exit code of the executed command and report the lint check's real pass/fail status.

  3. Actual behavior

    In VS Code Remote-SSH terminal mode, execute_command lost stdout, stderr, and the nonzero exit status of the underlying shell command and returned a generic success result instead — even though the terminal itself showed the command's real output and an exit code of 7. A failing Ruff lint check was reported as passing as a direct result. The reporter's minimal repro (`exit 7` plus stdout/stderr probes over Remote-SSH) reproduced the same false success on both Cline 4.0.11 and 4.0.12.

  4. Damage

    A failing lint check was recorded as passing and "inaccurate verification evidence" was committed to the project's own issue tracker, per the reporter. No data loss, but the defect undermines the core guarantee that an agent's self-reported command results reflect what actually happened — relevant to any check (tests, lint, build) run through execute_command in a Remote-SSH session.

Full write-up

A user running Cline 4.0.12 inside a VS Code Remote-SSH session to a Linux VM found that execute_command silently dropped the real output and exit status of shell commands, always reporting a generic success. The user's own words: "This is not only cosmetic: it caused a Ruff failure to be treated as passing and inaccurate verification evidence to be committed to the project issue tracker." A minimal reproduction — a bash one-liner that prints distinct stdout and stderr markers and exits with status 7 — showed the VS Code terminal correctly displaying both streams and the exit code, while Cline's tool result reported success regardless. The same false-positive behavior reproduced on both 4.0.11 and 4.0.12, meaning the defect had already survived one release cycle before being reported.

Classification

Agent
Cline
Failure mode
Logic Error
Root cause
Tool Misuse
Domain
Testing
Language
Python
MIT AI Risk Repository (our mapping)
7.3 Lack of capability or robustness taxonomy
Source
User Report

Related incidents

8.0
Claude Code hand-ran an unrequested lftp mirror --delete against a production host, wiping a customer photo-uploads directory, then reported a failed deploy as successful (GitHub #89014)
9.0
A Claude Code sub-agent ran rm -rf on the 8.3 short-name alias of a Windows home directory, wiped ~116GB, and falsely reported the deletion had stopped while it kept running for 45+ minutes (GitHub #99193)
6.0
Aider leaks model-provider API keys to child processes spawned via /run, /test, lint commands, and /git
6.0
Cline's tool-call JSON repair silently executed truncated write_file and terminal arguments as valid
Discuss on Hacker News
Cite this record
StupidLLM. "STUPID-2026-0072: Cline's execute_command reported a failing Ruff lint check as passing over Remote-SSH." AI Agent Incident Database, 2026. https://www.stupidllm.com/incident/STUPID-2026-0072/ (accessed 2026-11-09). CC BY 4.0.

← STUPID-2026-0071By IDSTUPID-2026-0073 →

Get told when an agent breaks something

We document AI agent failures daily, severity-scored against a published scale. Each Monday, if any scored 7 or above that week — deleted data, leaked secrets, broken production — you get one email with the sources. When nothing did, you get nothing.

This database is callable over MCP — query it from inside your agent.