Simon Willison • 3/6/2026

Clinejection — Compromising Cline's Production Releases just by Prompting an Issue Triager

The article describes a sophisticated security attack called 'Clinejection.' An attacker used prompt injection in a GitHub issue title to compromise an AI-powered issue triage workflow. This led to cache poisoning, allowing the attacker to steal NPM publishing secrets from a release workflow and publish a malicious package version (cline@2.3.0). It highlights critical vulnerabilities in AI-integrated CI/CD pipelines and GitHub Actions cache sharing.

0 comments

#ci/cd #prompt injection #Github Actions