Feb 17, 2026Confirmed
Prompt injection in Cline's Claude issue-triage workflow led to an unauthorized cline@2.3.0 package release
Rogue: Went past its access, Caused harmAI loose in the worldInjectionDERIVED
Approved by person, Oct 11, 2026. How entries are approved
An unknown actor reportedly used prompt injection against Cline's Claude-powered GitHub issue-triage workflow, plus a GitHub Actions cache-poisoning path, to get publishing credentials. On February 17, 2026, an npm token was used to publish cline@2.3.0, which installed OpenClaw without user intent. Cline deprecated the release and revoked the token that day.
What this means for youAI helpers that read public text can be tricked by instructions hidden in it, and that can reach the software people install. If you use developer tools with AI agents, check which accounts and keys those agents can reach, and keep tools updated from trusted releases.
Sources
- AI Incident Databasehttps://incidentdatabase.ai/cite/1680
Data from the AI Incident Database (incidentdatabase.ai), licensed CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). McGregor, S. (2021) Preventing Repeated Real World AI Failures by Cataloging Incidents: The AI Incident Database. IAAI-21.
Source data license: CC BY-SA 4.0 (database). Report contents keep their own rights; reports.text, submissions, images and videos are excluded from the data license.
rogue:R3rogue:R4
Covered by snapshot 45
da93f03b406f409940d0a6ef47b526607f82ebf457d98f69299b88aceede576a
This entry is record number 2244. It has not been edited since it was approved; the hash above would not match if it had. How to verify