STUPID-2026-0077
Cline's Plan mode edits files without switching to Act or asking permission
Why 4/10
Plan mode wrote files without approval: a broken safety gate, but no data loss reported.
- Scope
- 1/4
- A few files, one session, one credential, or a small cost
- Recoverability
- 1/3
- Fully recovered, with effort
- Did it happen
- 2/2
- Happened in real use
- Beyond the user
- 0/1
- Only the user's own non-production work
The score is the sum of these four factors. How each factor is scored · scored 2026-10-29
Instruction given
Stay in Plan mode — gather information and propose changes only; do not write or edit files until the user explicitly switches to Act mode.
Expected behavior
Plan mode is read-only: the agent should never call write_to_file or replace_in_file, and any switch to Act mode should require explicit user action via the Plan/Act toggle.
Actual behavior
While still in Plan mode, Cline called write_to_file and replace_in_file and modified files directly, without requesting approval or switching to Act mode first. The reporter traced it to the v4.0.0 SDK migration, which reworked Plan/Act mode handling through new SDK coordinators.
Damage
No data loss reported, but the defect breaks the one guarantee Plan mode exists to provide — that nothing is written to disk until the user reviews a plan and explicitly approves it. A user relying on Plan mode as a safety gate before letting the agent touch a repo gets silent writes instead. The same underlying bug was first reported three months earlier (cline/cline#10497, 2026-05-01, with an explicit repro: a planning prompt after which the model auto-switched to Act and began implementing without confirmation) and reported again in between (cline/cline#12907, 2026-08-04, closed as a duplicate of #10497) — three independent reports across three months against a boundary that is still not enforced.
Full write-up
A Cline user running v4.1.7 with a self-hosted DeepSeek model via LiteLLM found that Plan mode — meant to restrict the agent to read-only information gathering until the user explicitly switches to Act mode — did not hold: Cline called write_to_file and replace_in_file directly while still in Plan mode, with no approval prompt and no mode switch. The reporter pinned the regression to the v4.0.0 SDK migration, which reworked Plan/Act handling through new SDK coordinators, and linked two earlier reports of the same boundary failing: cline/cline#10497 (filed 2026-05-01, with a clean reproduction — a planning prompt after which the model auto-switched to Act mode and began implementing without confirmation, quoting Cline's own prior refusal message: "You must manually toggle to Act Mode using the Plan/Act toggle button below. I do not have the ability to switch modes myself") and cline/cline#12907 (filed 2026-08-04, closed as a duplicate of #10497). Three reports spanning three months describe the same unenforced boundary, and as of this incident's publication #13140 remains open with no maintainer response.
Classification
- Agent
- Cline
- Failure mode
- Ignored Instructions
- Root cause
- Logic Error
- Domain
- Security
- OWASP Agentic Top 10 (our mapping)
- ASI02 Tool Misuse and Exploitation list
- MIT AI Risk Repository (our mapping)
- 7.3 Lack of capability or robustness · 5.2 Loss of human agency and autonomy taxonomy
- Source
- Github Issue
Related incidents
Cite this record
StupidLLM. "STUPID-2026-0077: Cline's Plan mode edits files without switching to Act or asking permission." AI Agent Incident Database, 2026. https://www.stupidllm.com/incident/STUPID-2026-0077/ (accessed 2026-11-13). CC BY 4.0.
← STUPID-2026-0076By IDSTUPID-2026-0078 →
Get told when an agent breaks something
We document AI agent failures daily, severity-scored against a published scale. Each Monday, if any scored 7 or above that week — deleted data, leaked secrets, broken production — you get one email with the sources. When nothing did, you get nothing.
This database is callable over MCP — query it from inside your agent.