OOF-AII-616989

Unknown Actor Reportedly Exploited Cline's Claude-Powered GitHub Issue-Triage Workflow and Published an Unauthorized Cline CLI Package

An unknown actor reportedly exploited prompt injection in Cline's Claude-powered GitHub issue-triage workflow and a GitHub Actions cache-poisoning path to obtain publication credentials. On February 17, 2026, a still-valid npm token was used to publish unauthorized cline@2.3.0, which installed OpenClaw without user intent. Cline said OpenClaw was non-malicious; it deprecated the release and revoked the token that day, while reporting that it found no evidence of user-data exposure.

Event date
2026-02-17
Country
Location not specified
Severity
Low
Evidence state
Single-source

Assessment status

Generated from available public incident evidence using OOF® governance methodology. It is not an official investigation, legal determination, regulatory finding, certification, or OOF® Approved Assessment.

View source record from AI Incident Database (Responsible AI Collaborative)

Assessment confidence dimensions

Source corroboration
Single-source

Measures source-group corroboration only; it does not establish factual truth.

Extraction completeness
Moderate

Measures populated source fields after deterministic normalization; it does not measure correctness.

Methodological assignment confidence
Moderate

Measures automated assignment support; substantive correctness requires authorized human review.

Known facts from the incident record

  • The incident record identifies the event date as 2026-02-17.

Reported claims

  • An unknown actor reportedly exploited prompt injection in Cline's Claude-powered GitHub issue-triage workflow and a GitHub Actions cache-poisoning path to obtain publication credentials. On February 17, 2026, a still-valid npm token was used to publish unauthorized cline@2.3.0, which installed OpenClaw without user intent. Cline said OpenClaw was non-malicious; it deprecated the release and revoked the token that day, while reporting that it found no evidence of user-data exposure.

Material unknowns

  • Independent corroboration is not established in the available incident record.

Primary governance problem

The incident appears to expose a governance problem involving agent, user, intent. Available reporting supports preliminary methodological interpretation, not a finding of fault or non-compliance.

Architecture intelligence

MGIA™ — Memory Governance Intelligence Architecture

Primary architecture

The reported agent, user, intent concern falls within the governed questions represented by MGIA™ — Memory Governance Intelligence Architecture.

Governance focus: How should agent, user, intent be governed in the conditions described by the available incident evidence?

Deeper methodology is withheld because the available evidence does not justify a Parent Standard or Core Module.

CLIA® — Cognitive Governance Intelligence Architecture

Contributing architecture

The reported agent, evidence, intent concern falls within the governed questions represented by CLIA® — Cognitive Governance Intelligence Architecture.

Governance focus: How should agent, evidence, intent be governed in the conditions described by the available incident evidence?

Deeper methodology is withheld because the available evidence does not justify a Parent Standard or Core Module.

Preliminary governance questions

  • How should agent, user, intent be governed in the conditions described by the available incident evidence?
  • How should agent, evidence, intent be governed in the conditions described by the available incident evidence?
  • What operational authority and controls applied to Cline Bot Inc., Ai Agent System Deployers, Threat Actors at the relevant time?
  • What evidence would establish how Claude Code, Ai Agent Systems, Github Actions, Cline Cli, Npm Registry, Claude Code Action, Claude produced or enabled the reported outcome?
  • What additional independent evidence is required to resolve the material evidence gaps?

Evidence gaps and limitations

  • Only one independent source group is represented; corroboration is not established.
  • Country could not be resolved from the available evidence.
  • AI technology is not specified in the source record.
  • industry is not specified in the source record.
  • AI system type is not specified in the source record.

Return to the public incident index