GitHub Issue Title Triggers AI Assistant Compromise

A four-hop supply chain attack on Cline, an AI coding assistant, exposed how untrusted input in a GitHub issue title can lead to malicious package publication. Founders must review automation and cache configurations.

In December 2025, Cline, an AI coding assistant used by over 5 million developers, suffered a four-hop supply chain compromise originating from a GitHub issue title. A misconfigured triage automation workflow, designed to give an AI agent write access, allowed any GitHub user to trigger shell commands. This vulnerability led to the silent installation of a second AI agent on user machines via a malicious npm package.

Open Permissions Enabled Initial Access

The compromise began with Cline's triage automation, configured with broad tool permissions and a trigger condition open to any GitHub user, not just project contributors. This setup allowed unauthenticated input to invoke the workflow. Specifically, the allowed_non_write_users: "*" setting in the triage workflow config granted universal access, enabling the initial breach. The allowedTools "Bash,Read,Write,Edit" permission further amplified the risk, giving the AI agent extensive capabilities.

Prompt Injection via Issue Title

The core vulnerability involved prompt injection through an unsanitized GitHub issue title. The AI model, Claude, received the untrusted string directly, with its tool access already granted. While the exact injected payload has not been publicly disclosed by first-party sources like GHSA, the mechanism is confirmed: a malicious instruction embedded in an issue title bypassed input validation to control the AI agent's actions.

Cache Poisoning and Token Exfiltration

The injected prompt deployed a tool identified as "Cacheract" by independent postmortems from Snyk and the Cloud Security Alliance. This tool flooded the Continuous Integration (CI) cache with over 10GB of junk data, leveraging standard Least Recently Used (LRU) eviction to remove legitimate entries. A nightly release workflow then restored this poisoned cache around 2 AM UTC. Running within the compromised cache, the workflow exfiltrated three critical publish tokens: NPM_RELEASE_TOKEN, VSCE_PAT, and OVSX_PAT.

Malicious Package Publication

With the exfiltrated tokens, the attackers published cline@2.3.0 to npm. This version contained a postinstall script that silently installed a second, malicious AI agent globally on user machines without consent. Cline's own security advisory confirmed this, stating that "an AI agent, installed by an AI agent, with no user consent" was the outcome. The exploit landed in the wild on February 17, 2026, eight days after public disclosure, resulting in approximately 4,000 installs within eight hours before detection.

What We'd Change

Founders integrating AI into development workflows must implement stricter controls than those observed in the Cline incident. The "Three checks for your own repo" outlined in the source provide a starting point for securing AI-integrated pipelines.

Restrict AI Workflow Triggers

The first check addresses the trigger condition: "Can any GitHub user (not just contributors) trigger your AI/automation workflows?" The Cline compromise originated because allowed_non_write_users: "*" permitted unauthenticated input. Founders should configure AI-driven automation to respond only to trusted sources, such as authenticated repository contributors or specific internal service accounts. This prevents external actors from directly manipulating AI agents through public interfaces like issue titles or pull request descriptions. Reviewing workflow_dispatch permissions and on: triggers in GitHub Actions is critical to ensure only authorized entities can initiate sensitive workflows.

Sanitize Cache Keys and Inputs

The second check asks: "Are your cache keys derived from anything user-controlled — issue titles, branch names, PR descriptions?" Cline's cache poisoning relied on an unsanitized input influencing cache logic. Cache keys must be derived from immutable, non-user-controlled identifiers. If user input is necessary for cache key generation, it must undergo rigorous sanitization and validation to prevent injection attacks. This extends beyond cache keys to all inputs processed by AI agents, ensuring no untrusted string reaches the model with elevated permissions. Implement strict schema validation and allow-listing for all AI prompts and parameters.

Implement Short-Lived, OIDC Tokens

The third check focuses on token management: "Are your publish tokens long-lived and static, or do they rotate through OIDC?" Cline's exfiltration of static NPM_RELEASE_TOKEN, VSCE_PAT, and OVSX_PAT allowed attackers to publish malicious packages. Founders should transition from long-lived Personal Access Tokens (PATs) to OpenID Connect (OIDC) for CI/CD authentication. OIDC-based tokens are short-lived and dynamically generated for specific jobs, significantly reducing the window of opportunity for attackers even if a token is compromised. This practice aligns with least privilege principles, limiting the blast radius of any successful exfiltration.

Landing

The Cline incident underscores the escalating risk of supply chain attacks targeting AI-integrated development environments. As AI agents gain more autonomy and write access within critical infrastructure, the attack surface expands beyond traditional code vulnerabilities to include prompt injection and misconfigured automation. Securing these pipelines requires a fundamental shift in how developers approach input validation, permission management, and credential handling. Vigilance against untrusted inputs, coupled with robust identity and access management for automated systems, is now paramount for maintaining software integrity.

The investor read

The Cline compromise highlights a growing attack vector in the developer tools and AI infrastructure market: supply chain vulnerabilities within AI-integrated CI/CD pipelines. Investors should note the increasing need for robust security solutions that specifically address prompt injection, AI agent permissioning, and secure credential management for automated systems. Companies building AI-powered developer tools must prioritize security-by-design, as breaches like Cline's can rapidly erode user trust and adoption. This incident signals a maturing market where security assurances will become a key differentiator, potentially driving M&A activity for specialized AI security firms or increased R&D investment by incumbents. The shift from static tokens to OIDC is a clear benchmark for evaluating a dev tool's security posture.