Unknown Actor Reportedly Exploited Cline's Claude-Powered GitHub Issue-Triage Workflow and Published an Unauthorized Cline CLI Package

An unknown actor reportedly exploited prompt injection in Cline's Claude-powered GitHub issue-triage workflow and a GitHub Actions cache-poisoning path to obtain publication credentials. On February 17, 2026, a still-valid npm token was used to publish unauthorized cline@2.3.0, which installed OpenClaw without user intent. Cline said OpenClaw was non-malicious; it deprecated the release and revoked the token that day, while reporting that it found no evidence of user-data exposure.

Risk classification

• Primary risk domain: 2 Privacy & Security
• Primary risk subdomain: 2.2 AI system security vulnerabilities and attacks

The incident directly stems from a prompt injection vulnerability in the Claude-based triage agent, which allowed unauthorized code execution and subsequent credential theft.

Additional risk subdomains

• 7.3 Lack of capability or robustness: The AI system lacked the robustness to safely handle adversarial prompt injections in user-submitted issue titles.

Causal factors

• Entity: AI
• Intent: Unintentional
• Timing: Post-deployment

The incident was initiated by a prompt injection vulnerability in an active, deployed AI triage agent, which executed unintended commands.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The AI system is described as an automated issue triage chatbot ('automatically triage incoming issues... respond to the issue') which interacts with users, placing it under transparency obligations for chatbots.

AI system and alleged parties

• AI system: Claude (Anthropic)
• AI purpose: Chatbot; Question Answering
• Behaviour type: Agent
• Alleged developer: Anthropic, AI agent system developers
• Alleged deployer: Threat actors, Cline Bot Inc., AI agent system deployers
• Alleged harmed parties: Software developers, Cline CLI users, Cline Bot Inc.

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Negligible. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

People affected

• Occurrences reported: 1
• People reportedly exposed: 4000

Potential causes

Management

• Delayed Vulnerability Response: Management failed to act on security reports until public disclosure.
• Inadequate Risk Assessment: No risk assessment of giving an LLM shell access in CI/CD.

Technology

• Vulnerable Claude Action Config: Claude was given broad tools like Bash, Write, and Edit in triage.
• Shared Actions Cache Scope: Low-privilege triage workflow shared cache scope with nightly release.
• Inadequate Token Verification: NPM token rotation verification relied on a flawed dashboard view.

Data Inputs

• Untrusted Issue Title Input: Issue titles were interpolated directly into the LLM prompt.
• Lack of Input Sanitization: No sanitization of user-submitted issue titles before processing.

Human Factors

• Tolerance for CI Failures: Developers patched CI to ignore anomalous post-checkout failures.
• Token Rotation Error: Maintainers deleted the wrong NPM token during the rotation process.

Process and Methods

• No Private Disclosure Triaging: Security reports sent privately were ignored for six weeks.
• No OIDC Provenance Initially: Releases relied on long-lived tokens instead of OIDC verification.
• Shared Release Credentials: Nightly and production releases shared the same publication tokens.

Information quality

• Classification confidence: High
• Reason for confidence: The reports from both the security researcher and the affected company provide highly detailed, matching, and technically precise accounts of the vulnerability, the exploit, and the timeline.

An autonomous AI triage agent was exploited via prompt injection, leading to credential theft and a supply chain compromise affecting 4,000 downloads of an NPM package. While the immediate national security impact is minor, the incident illustrates a significant emerging risk vector where autonomous AI agents with over-privileged access can be weaponized to compromise software supply chains.

• Overall national security impact: Minor
• Scope: Multiple nations
• Primary target: No clear primary
• Other affected: Unknown
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. The active vulnerability has been patched and credentials rotated, transitioning this from an active crisis to a long-term security lesson.
• Autonomy: Full autonomy. The AI triage agent was granted autonomous Bash execution privileges, allowing it to execute commands directly without human oversight.
• Novelty: Evolved capability. Represents an evolved threat where prompt injection against an autonomous agent is successfully chained to achieve supply chain compromise.

Impact by dimension

• Physical security: Negligible. The compromise affected an open-source developer tool and did not impact physical systems, critical infrastructure, or human safety.
• Information security: Negligible. No significant intelligence compromise or information warfare operations were indicated in the incident reports.
• Sovereignty: Negligible. The incident was confined to a public software repository and had no impact on government operations, decision-making, or state sovereignty.
• Economic security: Minor. Represents a minor software supply chain compromise affecting approximately 4,000 downloads of a developer tool. While highlighting emerging AI security risks, the overall economic and strategic technological impact remains limited.
• Societal stability: Negligible. The incident did not involve mass surveillance, human rights violations, or threats to societal stability.