This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
An AI-powered GitHub issue triage agent in the Cline repository was exploited via prompt injection, leading to cache poisoning, credential theft, and the unauthorized publication of a compromised NPM package version downloaded 4,000 times.
An unknown actor reportedly exploited prompt injection in Cline's Claude-powered GitHub issue-triage workflow and a GitHub Actions cache-poisoning path to obtain publication credentials. On February 17, 2026, a still-valid npm token was used to publish unauthorized cline@2.3.0, which installed OpenClaw without user intent. Cline said OpenClaw was non-malicious; it deprecated the release and revoked the token that day, while reporting that it found no evidence of user-data exposure.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Vulnerabilities that can be exploited in AI systems, software development toolchains, and hardware, resulting in unauthorized access, data and privacy breaches, or system manipulation causing unsafe outputs or behavior.
Also classified as
The AI system lacked the robustness to safely handle adversarial prompt injections in user-submitted issue titles.
The incident directly stems from a prompt injection vulnerability in the Claude-based triage agent, which allowed unauthorized code execution and subsequent credential theft.
AI system
Due to a decision or action made by an AI system
Unintentional
Due to an unexpected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The incident was initiated by a prompt injection vulnerability in an active, deployed AI triage agent, which executed unintended commands.
An autonomous AI triage agent was exploited via prompt injection, leading to credential theft and a supply chain compromise affecting 4,000 downloads of an NPM package. While the immediate national security impact is minor, the incident illustrates a significant emerging risk vector where autonomous AI agents with over-privileged access can be weaponized to compromise software supply chains.
The triage workflow used Claude-code-action, which spun up Claude with access to the repository and a broad set of tools (Bash, Read, Write, Edit) to autonomously analyze and respond to issues.
Limited Risk: The AI system is described as an automated issue triage chatbot ('automatically triage incoming issues... respond to the issue') which interacts with users, placing it under transparency obligations for chatbots.
The AI system was deployed as an automated triage agent to analyze and respond to incoming GitHub issues, acting as a conversational chatbot.
The reports from both the security researcher and the affected company provide highly detailed, matching, and technically precise accounts of the vulnerability, the exploit, and the timeline.
None
Technology
Vulnerable Claude Action Config
Claude was given broad tools like Bash, Write, and Edit in triage.
Shared Actions Cache Scope
Low-privilege triage workflow shared cache scope with nightly release.
Inadequate Token Verification
NPM token rotation verification relied on a flawed dashboard view.
Data Inputs
Untrusted Issue Title Input
Issue titles were interpolated directly into the LLM prompt.
Lack of Input Sanitization
No sanitization of user-submitted issue titles before processing.
Human Factors
Tolerance for CI Failures
Developers patched CI to ignore anomalous post-checkout failures.
Token Rotation Error
Maintainers deleted the wrong NPM token during the rotation process.
Process and Methods
No Private Disclosure Triaging
Security reports sent privately were ignored for six weeks.
No OIDC Provenance Initially
Releases relied on long-lived tokens instead of OIDC verification.
Shared Release Credentials
Nightly and production releases shared the same publication tokens.
Management
Delayed Vulnerability Response
Management failed to act on security reports until public disclosure.
Inadequate Risk Assessment
No risk assessment of giving an LLM shell access in CI/CD.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
