Cline's tool-call JSON repair silently executed truncated write_file and terminal arguments as valid

1. Instruction given

   None specific to this bug — the defect lives in Cline's tool-call streaming pipeline itself and can trigger during any task where the model's tool-call arguments get cut off mid-value, most commonly by hitting a max_tokens limit while still writing a long string argument (file contents, a terminal command, a commit message).

2. Expected behavior

   When a streamed tool call's arguments are truncated mid-value, Cline should surface the truncation as a recoverable error so the model can retry with the full argument, rather than treating the incomplete data as a successfully parsed tool call and executing it.

3. Actual behavior

   Cline's experimental_repairToolCall path falls back to the jsonrepair library when standard JSON parsing of a streamed tool call fails. jsonrepair closes unterminated strings as-is instead of rejecting them, so a tool call cut off mid-argument comes out as syntactically valid but semantically corrupted JSON — and Cline executed it without any warning that truncation had occurred. Because the affected code path is generic (ai-sdk.ts's registration of experimental_repairToolCall, and json.ts's use of jsonrepair), it applies to any tool accepting a free-form string argument, including write_file (file contents) and terminal/shell command execution. The reporter's minimal repro fed a truncated write_file call — `{"path":"config/database.yml","content":"production:\n host: db.prod.internal\n password: correct-horse-battery-sta` — into the parsing path and got back a valid-looking object with the cut-off password string, no error raised.

4. Damage

   No named production incident was reported alongside this issue — it was filed as a code-level defect with a reproduction, not a user recounting data loss. The risk it describes is real regardless: any write_file or terminal argument truncated mid-string by a max_tokens limit would be silently written or executed with corrupted content (e.g. a cut-off password or config value landing on disk, or a partial shell command running) with no diagnostic signal to the model or the user. Cline's maintainers treated the report as credible — it was assigned to a maintainer and fixed in PR #13015, merged six days later on 2026-08-12, which adds truncation detection that rejects unterminated strings instead of repairing them.

Classification

Agent

Cline

Failure mode

Logic Error

Root cause

Other

Domain

Infra

OWASP Agentic Top 10 (our mapping)

ASI02 Tool Misuse and Exploitation list

MIT AI Risk Repository (our mapping)

7.3 Lack of capability or robustness taxonomy

Source

Github Issue

StupidLLM. "STUPID-2026-0076: Cline's tool-call JSON repair silently executed truncated write_file and terminal arguments as valid." AI Agent Incident Database, 2026. https://www.stupidllm.com/incident/STUPID-2026-0076/ (accessed 2026-11-12). CC BY 4.0.

← STUPID-2026-0075By IDSTUPID-2026-0077 →