Disclosed vulnerability
Realized harm
Clinejection: prompt injection in a GitHub issue title chains through Actions cache poisoning to Cline's release credentials
AIR-2026-0036 AIR record · 2026-03-cline-clinejection-supply-chain
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
On February 17, 2026 at 3:26 AM PT, an unauthorized party used a compromised npm publish token to publish an update to Cline CLI on the NPM registry: cline@2.3.0.adnanthekhan.com
The record
Disclosed
2026-02-09
Occurred
2025-12-21
Vendor
Cline
Product
Cline (AI coding IDE extension) release pipeline
Risk domain
Access control and permissions › Credential theft
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — Cline's CI agent executed the injected chain and reached publishing credentials
Attack surface
Coding agent
Autonomy level
Fully autonomous
Initial vector
Indirect prompt injection github issue title
Impact type
Unauthorized package publish, Credential theft, Unauthorized software installation
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0012 – Valid Accounts
- NIST AI RMF
- MEASURE 2.7
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Use secure credential storage; Implement short-lived tokens.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Cline CLI users who installed version 2.3.0 during an approximately eight-hour window; the broader extension release channels were exposed, but Cline found no unauthorized releases there
Capability abused
Defense & remediation
Recorded defense
GitHub Actions cache scoping; workflow permissions
Guardrail kinds
Permission scope
Guardrail outcome
Silent
Fix shipped
removed the agent triage workflow, removed caches from release workflows, rotated credentials, replaced the unauthorized npm package after roughly eight hours, and moved npm publishing to OIDC provenance
Taxonomy & references
Curator notes
Adnan Khan disclosed the issue-title prompt-injection and cache-poisoning chain on February 9. Cline initially reported no unauthorized release during the December 21–February 9 exposure window, but later confirmed that the wrong npm token had been revoked and the exposed token was used on February 17 to publish cline@2.3.0 with an OpenClaw postinstall script. impact_realized is tied to that confirmed unauthorized publish and installations during its eight-hour window, not to the hypothetical millions-user extension compromise.
Supporting sources
Cite as
Enkrypt AI. "Clinejection: prompt injection in a GitHub issue title chains through Actions cache poisoning to Cline's release credentials". AIR, AIR-2026-0036. https://agentincident.vercel.app/i/AIR-2026-0036/ (accessed 2026-10-19).