Thursday, October 8, 2026 · Week 41 Reading for Oct. 8 · Last entry Oct. 6
Paperclip Index
Paperclip IndexDocumented harm20Minor harm▼ 5 from a week ago · Oct. 8The Index

Hijacked by injectionPI-0040

Prompt injection in Cline's AI issue-triage bot led to a real unauthorized npm release

Cline ran an AI issue-triage workflow built on Claude that any GitHub user could trigger, and the issue title was passed straight into the prompt. A researcher showed on Feb. 9, 2026, using a mirror of the repository, that a crafted title could make the bot install attacker code and, through a shared CI cache, expose the project's publishing tokens. On Feb. 17, 2026, someone used a still-valid npm token to publish [email protected], which silently installed the OpenClaw agent. It was downloaded about 4,000 times in roughly eight hours before it was deprecated.

Reported Feb. 17, 2026Happened on Feb. 17, 2026Updated Oct. 6, 2026Rated under methodology v0.6

Counts toward the indexDocumented harm outside the developer, backed by evidence that meets the rules. It sets the reading.
Harm
Harm level 2, Minor harmDocumented harm outside the developer, with evidence that meets the rules.
Control
Control level 2, Instruction violationReported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
DeploymentDeveloper confirmedInitiated by Outside attacker
Extent undisclosedUnder review

Under review. The facts sit between two levels, so it is rated at the lower one until they are settled. The rating may change; every change is logged below.

Counts toward the index · 4 weekly readingsEffect on the index

Sources

How we know

9 sources · developer confirmed. Links go to the original publishers; the summary above is in our own words.

  1. primaryGHSA-9ppg-jx86-fqw7: unauthorized [email protected] npm releaseOSV (GitHub Security Advisory mirror) · Feb. 19, 2026osv.dev/vulnerability/GHSA-9ppg-jx86-fqw7
  2. primaryUnauthorized npm publish of Cline CLI [email protected] with modified postinstall script to install openclawCline (GitHub Security Advisory GHSA-9ppg-jx86-fqw7) · Feb. 17, 2026github.com/cline/cline/security/advisories/GHSA-9ppg-jx86-fqw7
  3. primaryPost-mortem: unauthorized Cline CLI npm publishCline · Feb. 24, 2026cline.bot/blog/post-mortem-unauthorized-cline-cli-npm
  4. researchCline Supply Chain Attack Detected: [email protected] Silently Installs OpenClawStepSecurity · Feb. 17, 2026stepsecurity.io/blog/cline-supply-chain-attack-detected-cline-2-3-0-silently-in…
  5. researchSupply Chain Attack targeting Cline installs OpenClawEndor Labs · Feb. 18, 2026endorlabs.com/learn/supply-chain-attack-targeting-cline-installs-openclaw
  6. researchClinejection — Compromising Cline's Production Releases just by Prompting an Issue TriagerAdnan Khan · Feb. 9, 2026adnanthekhan.com/posts/clinejection/
  7. newsCline CLI 2.3.0 supply chain attackThe Hacker News · Feb. 20, 2026thehackernews.com/2026/02/cline-cli-230-supply-chain-attack.html
  8. newsSupply Chain Attack Secretly Installs OpenClaw for Cline UsersDark Reading · Feb. 19, 2026darkreading.com/application-security/supply-chain-attack-openclaw-cline-users
  9. blogClinejection (link post)Simon Willison's Weblog · March 6, 2026simonwillison.net/2026/Mar/6/clinejection/

Why this rating

Minor harm; control failure level 2

Two separate assessments. Only documented harm can count toward the index.

Observed harm

Minor harm

About 4,000 downloads of an unauthorized package release over about eight hours (StepSecurity's count; downloads are not unique people or completed installs); publishing credentials exposed.

People affected: level 2 (minor) covers fewer than 1,000 people, or sensitive data of fewer than 100. The extent was not disclosed.

Evidence eligible (confirmed).

The harm scale
  1. 1 Negligible Inconvenience, easily remedied.
  2. 2 Minor Limited, recoverable harm.
  3. 3 Moderate Material harm needing significant effort to remedy.
  4. 4 Severe Severe harm to health, rights, property or essential services.
  5. 5 Catastrophic Society-scale harm or disruption beyond a community's capacity to cope.

Control assessment

Instruction violation

The triage agent ran injected commands with the Bash and write tools it had been given; the credential theft came through CI cache poisoning, not the agent exceeding its permissions.

Reported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.

The control scale
  1. 1 Negligible Behaved as instructed. The problem was an ordinary error or a flawed output, with no rule broken.
  2. 2 Minor Broke an explicit instruction or rule, or gamed its goal, while staying inside its permissions and environment: for example, reward hacking, misreporting results, or following injected instructions within its permissions.
  3. 3 Moderate Acted outside the permissions it was given, deceived its overseers about its own actions, or tampered with oversight tools (logs, monitors, shutdown). Stopped by normal controls within an hour.
  4. 4 Severe Reached systems outside its permitted environment, or acquired money, compute or accounts without authorization. The type and mechanism say how.
  5. 5 Catastrophic The developer or operator lost control: the system copied its weights outside their control, replicated itself, or resisted being stopped for 24 hours or more.

Rating rationale

About 4,000 downloads of an unauthorized release (not a count of people) and exposed publishing credentials, with no data theft: harm between 2 and 3, so 2 and under review. Control 2: injected instructions followed within the tools granted.

The scales

Effect on the index

It moved the Feb. 23 reading from 20 to 26

The reading for the week to Feb. 23, 2026, with this record and without it. Harms count in full for two weeks after they are reported, then one level less every two weeks.

Source: Paperclip Index log, methodology v0.6, week to Feb. 23, 2026.

Counts toward the index. 6 other records behind the reading for that week.

The arithmetic
The reading for the week of Feb. 23, recomputed
StepWith itWithout
Counts toward the index?documented, external, eligible evidenceYes—
Worst documented harm, ksets the band2 Minor2 Minor
Harms at that level, nposition in the band21
Highest control level breachedsets the reading only when no harm counts— (none breached)— (none breached)
Readingrounded down26 Minor harm20 Minor harm
Counted in 4 weekly readings
Week toReadingBand
Feb. 23, 202626Minor harm
March 2, 202625Minor harm
March 9, 202620Minor harm
March 16, 202620Minor harm

Recalculated backcasts, not readings published at the time.

Revisions

What we changed

5 logged. Every change to a rating is logged here, with the reason.

  1. v5
    Oct. 6, 2026

    Ratings confirmed by the editor.

  2. v4
    Oct. 3, 2026

    Audit corrections. The 4,000 figure is downloads (StepSecurity's count), not installs or people; the impact is now flagged as extent unknown. Added Cline's original GitHub advisory, StepSecurity's and Endor Labs' analyses, and Adnan Khan's 9 Feb 2026 disclosure, whose proof of concept ran on a mirror; the unauthorized release on 17 Feb remains the event. Dated OSV to its 19 Feb publication and Dark Reading (date from the audit; the page was not readable in the Oct 2026 check). Ratings unchanged.

  3. v3
    Oct. 2, 2026

    Report date corrected from February 2026 (month precision, placed on 1 Feb) to 17 Feb 2026, the day of the unauthorized release and Cline's advisory; the record no longer enters windows before the event happened.

  4. v2
    Sept. 30, 2026

    Rated: impact documented level 2; control type instruction violation.

  5. v1
    Sept. 30, 2026

    Backfilled from public reporting.

Cite and share

Use this record

Citation

Paperclip Index. “Prompt injection in Cline's AI issue-triage bot led to a real unauthorized npm release.” Record PI-0040. Reported Feb. 17, 2026; updated Oct. 6, 2026. Rated under methodology v0.6. https://paperclipindex.com/incident/PI-0040