AI coding assistants promise productivity gains, but researchers at Mindgard have uncovered a critical vulnerability chain in Cline that transforms the tool into a security liability.
Four vulnerabilities discovered during a brief audit of the popular VSCode extension can enable attackers to exfiltrate API keys, execute arbitrary code, and leak sensitive model information all without user knowledge.
The findings underscore a fundamental security blind spot in LLM-based development tools: system prompts are not harmless configuration text.
Exploitation Chain Requires Nothing More Than Opening a Repository
Cline, with 3.8 million installs and 52,000 GitHub stars, was vulnerable to prompt-injection attacks when analyzing source code.
The most critical flaw allows attackers to plant malicious instructions directly into Python docstrings or Markdown configuration files.
When a developer opens an infected repository and asks Cline to analyze it, a routine development task, the agent faithfully executes attacker commands without user approval.
The researchers demonstrated three distinct exploitation paths, each bypassing Cline’s safety mechanisms through carefully crafted prompt injections embedded in source code.
The first vulnerability leverages DNS-based data exfiltration through seemingly benign ping commands.
Attackers embed instructions in file docstrings that coerce Cline into reading environment variables (including API keys) and encoding them into DNS queries sent to attacker-controlled domains.
Since ping commands are typically whitelisted as “safe,” the tool executes them without approval, leaking credentials through DNS logs.
A second critical flaw exploits Cline’s .clinerules directory feature. By placing malicious Markdown instructions in this special configuration directory, attackers can override the requires_approval flag for all executed commands.
This transforms dangerous operations, such as downloading and executing remote payloads, into “approved” actions, enabling complete system compromise.
The third vulnerability weaponizes time-of-check-time-of-use (TOCTOU) race conditions. Attackers create scripts that execute after a delay, allowing multiple prompt injections to assemble a complete malicious payload piece by piece.
The model cannot inspect the complete execution chain, making the attack invisible during analysis.
A critical insight from this research: system prompts are not mere configuration artifacts. Because Cline’s code is open source, attackers had both the functional specifications from the system prompt and implementation details.
This knowledge enabled precise targeting of semantic loopholes and linguistic brittleness in safety guardrails.
Mindgard disclosed all vulnerabilities in August 2025, but only after public pressure in October did the Cline team acknowledge the issues.
As of version 3.35.0, the vulnerabilities appear partially mitigated, though the researchers note they did not receive detailed information about implementation changes.
The incident highlights how early security engineering remains in the AI agent space and the urgent need to treat prompts as critical security surfaces rather than incidental implementation details.
Find this Story Interesting! Follow us on Google News, LinkedIn and X to Get More Instant Updates
%20(1).webp?fit=1068,580&ssl=1&description=Four vulnerabilities discovered during a brief audit of the popular VSCode extension can enable attackers to exfiltrate API keys){kind=link}