STUPID-2026-0077

Cline's Plan mode edits files without switching to Act or asking permission

4.5medium
August 10, 2026VerifiedReproducible

  1. Instruction given

    Stay in Plan mode — gather information and propose changes only; do not write or edit files until the user explicitly switches to Act mode.

  2. Expected behavior

    Plan mode is read-only: the agent should never call write_to_file or replace_in_file, and any switch to Act mode should require explicit user action via the Plan/Act toggle.

  3. Actual behavior

    While still in Plan mode, Cline called write_to_file and replace_in_file and modified files directly, without requesting approval or switching to Act mode first. The reporter traced it to the v4.0.0 SDK migration, which reworked Plan/Act mode handling through new SDK coordinators.

  4. Damage

    No data loss reported, but the defect breaks the one guarantee Plan mode exists to provide — that nothing is written to disk until the user reviews a plan and explicitly approves it. A user relying on Plan mode as a safety gate before letting the agent touch a repo gets silent writes instead. The same underlying bug was first reported three months earlier (cline/cline#10497, 2026-05-01, with an explicit repro: a planning prompt after which the model auto-switched to Act and began implementing without confirmation) and reported again in between (cline/cline#12907, 2026-08-04, closed as a duplicate of #10497) — three independent reports across three months against a boundary that is still not enforced.

A Cline user running v4.1.7 with a self-hosted DeepSeek model via LiteLLM found that Plan mode — meant to restrict the agent to read-only information gathering until the user explicitly switches to Act mode — did not hold: Cline called `write_to_file` and `replace_in_file` directly while still in Plan mode, with no approval prompt and no mode switch. The reporter pinned the regression to the v4.0.0 SDK migration, which reworked Plan/Act handling through new SDK coordinators, and linked two earlier reports of the same boundary failing: cline/cline#10497 (filed 2026-05-01, with a clean reproduction — a planning prompt after which the model auto-switched to Act mode and began implementing without confirmation, quoting Cline's own prior refusal message: "You must manually toggle to Act Mode using the Plan/Act toggle button below. I do not have the ability to switch modes myself") and cline/cline#12907 (filed 2026-08-04, closed as a duplicate of #10497). Three reports spanning three months describe the same unenforced boundary, and as of this incident's publication #13140 remains open with no maintainer response.

Classification

Agent
Cline
Failure mode
Ignored Instructions
Root cause
Logic Error
Domain
Security
Source
Github Issue

Related incidents

10.0
Clinejection: an AI issue-triage workflow enabled arbitrary code execution on the CI runner
5.8
Cline's tool-call JSON repair silently executed truncated write_file and terminal arguments as valid
4.8
Cline sessions marked "failed" kept burning tokens for 20+ hours, and FREE-labeled models billed credits anyway
3.8
Cline's execute_command reported a failing Ruff lint check as passing over Remote-SSH
Discuss on Hacker News

Get told when an agent breaks something

We document AI agent failures daily, severity-scored against a published scale. When one lands at 7.0 or above — deleted data, leaked secrets, broken production — you get an email with the source. When nothing does, you get nothing.

This database is callable over MCP — query it from inside your agent.