On February 9, 2026, security researchers disclosed a prompt-injection vulnerability in Cline's CI/CD tooling that was actively exploited roughly a week later, on February 17. The attack chain, documented in detail by Snyk and independently corroborated by a Cloud Security Alliance research note, started somewhere almost absurdly mundane: a maliciously crafted GitHub issue title. An AI triage bot reading that title treated part of it as an instruction rather than untrusted user content, which cascaded into cache poisoning inside the CI/CD pipeline and, ultimately, an unauthorized npm package publish — the kind of supply-chain compromise that can quietly reach every downstream user of the published package, not just the original target.

The practical damage was contained quickly. Cline's team shipped a fix within roughly 30 minutes of the exploit being identified, and the affected npm CLI window is reported at around 8 hours total. That's a genuinely fast response for a supply-chain incident, and it deserves to be said plainly rather than buried under the alarming part of the story.

What makes "Clinejection" worth a dedicated section instead of a single bullet point is the threat class it represents, not just the specific bug that got patched. Any AI system that reads untrusted external content — a GitHub issue, a pull request comment, a web page — and treats part of that content as an instruction is vulnerable to the same basic pattern: hide a command inside data the AI wasn't expecting to need to defend against. Cline fixed this specific exploit. The underlying risk category is one every team running AI agents inside CI/CD pipelines should take as a standing design constraint, not a one-time patch to forget about.

The honest starting point for evaluating Cline in 2026 is that "free and open source" is doing real work as a differentiator, not just a marketing line. A genuinely capable agentic coding tool with no seat fee, Apache-2.0 licensing, and the freedom to run any model — including local ones at zero cost — is a real departure from a category where $20/month has become the default assumption. That matters most for exactly the developers Cline is positioned for: people who want deep agent capability without committing to one vendor's bundled pricing.

The MCP Marketplace and multi-agent team features are where Cline's ambition shows most clearly. Connecting an agent to a team's actual databases, issue trackers, and internal APIs — rather than leaving it to operate on code in isolation — is the direction serious coding agents are converging on across the industry this year, and Cline's one-click server installs make that less of an integration project and more of a configuration choice.

The runaway-session problem deserves to be taken seriously rather than waved off as a rare edge case. A session marked "failed" that keeps calling APIs for 20 hours and racks up 416 calls isn't a one-in-a-million bug report — it's documented, specific, and exactly the kind of failure mode that matters more for a tool billed per token than it would for a flat-rate subscription product. Anyone adopting Cline for regular use should treat spend limits and active monitoring as a required part of setup, not an optional precaution for the unusually cautious.

Clinejection is the single most important fact in this entire review, and it's worth stating why directly: an AI reading a GitHub issue title and treating embedded text as an instruction rather than untrusted data isn't a Cline-specific flaw so much as a preview of a vulnerability class every AI coding tool with CI/CD access will eventually have to defend against. Cline's roughly 30-minute fix time after the exploit was identified is genuinely good incident response. That doesn't retroactively make the underlying risk theoretical — it makes Cline a documented case study other teams evaluating AI-in-CI/CD risk should actually read, not just a cautionary footnote.

Put those pieces together and the picture that emerges is neither "best free coding agent, full stop" nor "too risky to use." It's a genuinely capable, genuinely free tool that asks more active management from its user than a fully managed competitor would — spend limits, session monitoring, staying current on security patches — in exchange for real cost savings and real model freedom. That's a fair trade for the right user. It's not a trade every user should assume applies to them without reading this far.