STUPID-2026-0166
Cline's JetBrains crash-dump wrote the user's plaintext API key to disk every ~7 minutes (GitHub #15427)
Why 4/10
One credential exposed to a file on the user's own disk, not to a production system or third party (scope 1, impact 0). Rotating the key fixes it, so it is recoverable with effort rather than permanently lost (recoverability 1). This happened repeatedly in a real user's ordinary session, not a lab demonstration (realisation 2).
- Scope
- 1/4
- A few files, one session, one credential, or a small cost
- Recoverability
- 1/3
- Fully recovered, with effort
- Did it happen
- 2/2
- Happened in real use
- Beyond the user
- 0/1
- Only the user's own non-production work
The score is the sum of these four factors. How each factor is scored · scored 2026-11-15
Status and what to do
- Fix status
- Open
- Mitigation
- Delete or avoid retaining files under ~/.cline/heapsnapshots/, and rotate any provider API key that was active during a crash. Source
- Last reviewed
- 2026-11-15 · Report a correction to this record
Instruction given
None specific — the crash happens automatically during an ordinary Cline session in the JetBrains plugin; no user action beyond running it for a few minutes triggers it.
Expected behavior
The standalone cline-core process should stream editor state to the JetBrains plugin without unbounded memory growth, and if it does crash, its diagnostic heap snapshot should not contain the user's plaintext provider API key.
Actual behavior
cline-core (JetBrains plugin 2.0.9, core 4.1.26) streams a full serialized copy of its globalState — including the entire chat transcript and the user's provider API key in plaintext — to the JetBrains webview on every state change. Queued updates are never dropped when the IDE falls behind, so during a burst of changes the process's memory grew from an idle ~270MB to several GB within about 100 seconds, crashing with a JavaScript heap out-of-memory error (exit code 134) roughly every 6-7 minutes. Each crash wrote a ~240MB heap snapshot to ~/.cline/heapsnapshots/ containing hundreds of near-duplicate copies of the same globalState JSON, API key included, in plaintext.
Damage
No data loss or external exposure is reported — the heap snapshots and the plaintext key stayed on the user's own disk, and the service restarted automatically after each crash. Contributor mkondratek confirmed on 2026-11-02 that the OOM shares its root cause with a prior report (#15031): the state-update queue has no backpressure and never drops stale entries. The same maintainer separately acknowledged the plaintext-key exposure the reporter flagged, saying it "is getting its own fix" tracked apart from the OOM bug. As of 2026-11-09 only a telemetry commit had landed; neither fix was merged.
Full write-up
Cline's standalone core process crash-dumps itself when it runs out of memory — a reasonable diagnostic feature, except the dump is a near-verbatim copy of the service's full in-memory state. A user running the JetBrains plugin reported cline-core crashing with an out-of-memory error roughly every seven minutes, each crash writing a ~240MB heap snapshot to disk. Inside it: hundreds of duplicate copies of the session's serialized state, including the user's provider API key in plaintext. The crashes themselves trace to an unrelated queuing bug — state updates to the JetBrains webview are never dropped when the IDE falls behind, so a burst of changes balloons memory from idle levels to several gigabytes in under two minutes. A maintainer confirmed the crash's root cause and separately acknowledged the key exposure, but as of this writing only the crash fix was in progress; the plaintext key left sitting in a world-readable snapshot file was unaddressed.
Classification
- Agent
- Cline
- Failure mode
- Security Vulnerability
- Root cause
- Logic Error
- Domain
- Security
- Source
- Github Issue
Related incidents
Cite this record
StupidLLM. "STUPID-2026-0166: Cline's JetBrains crash-dump wrote the user's plaintext API key to disk every ~7 minutes (GitHub #15427)." AI Agent Incident Database, 2026. https://www.stupidllm.com/incident/STUPID-2026-0166/ (accessed 2026-11-15). CC BY 4.0.
← STUPID-2026-0165By ID
Get told when an agent breaks something
We document AI agent failures daily, severity-scored against a published scale. Each Monday, if any scored 7 or above that week — deleted data, leaked secrets, broken production — you get one email with the sources. When nothing did, you get nothing.
This database is callable over MCP — query it from inside your agent.