Cline AI Coding Agent vulnerable to prompt injection and data exfiltration
Researchers at Mindgard disclosed that Cline, an AI coding agent, is vulnerable to prompt injection attacks embedded in source code files. An attacker could exploit this to exfiltrate sensitive credentials and API keys from a user's environment without requiring user approval.
What happened
Cline Bot AI Coding Agent is vulnerable to prompt injection when analyzing source code files. Through malicious instructions planted in source code, Cline can be coerced into exfiltrating sensitive key material from a user's environment to an attacker-controlled location.
The prompt injection can be used to execute a ping command, which requires no user approval, in a way that will exfiltrate sensitive key material to an attacker-controlled location. Exploitation requires only opening the malicious source repository and asking Cline to analyze it.
Reported impact
The vulnerability allows attackers to exfiltrate API keys and other sensitive key material from a user's environment.
Index analysis
The vulnerability was discovered during a brief audit of the Cline Bot AI coding agent. Four issues were identified, ranging from model information leakage to API key exfiltration and remote code execution.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.