How “Clinejection” Turned an AI Bot into a Supply Chain Attack

On February 9, 2026, security researcher Adnan Khan publicly disclosed a vulnerability chain (dubbed "Clinejection") in the Cline repository that turned the popular AI coding tool's own issue triage bot into a supply chain attack vector. Eight days later, an unknown actor exploited the same flaw to publish an unauthorized version of the Cline CLI to npm , installing the OpenClaw AI agent on every developer machine that updated during an eight-hour window. The attack chain is notable not for any single novel technique, but for how it composes well-understood vulnerabilities (indirect prompt injection, GitHub Actions cache poisoning, credential model weaknesses) into a single exploit that requires nothing more than opening a GitHub issue. For Cline's 5+ million users, the actual impact was limited. The unauthorized cline@2.3.0 was live for roughly eight hours, and its payload (installing OpenClaw globally) was not overtly destructive. But the potential impact, pushing arbitrary code to e