Between August 2 and 6, 2026, Anaconda disclosed that a security incident involving Metabase — a business-intelligence tool Kilo's team used internally — exposed data for a subset of Kilo Code users. Anaconda's own incident writeup specifies that exposed data included user prompts and account information, and, for some users of Kilo's Slackbot integration specifically, Slack access tokens. This is a different category of incident than a prompt-injection exploit: it's a data exposure tied to internal tooling, not an attacker manipulating the AI agent itself.

Separately, two CVEs are publicly listed against Kilo Code in the National Vulnerability Database: CVE-2025-11445, describing a prompt-injection issue, and CVE-2026-8765, describing a path-traversal vulnerability in specific versions. Both are the kind of findings that show up in actively audited open-source security tools — their existence in NVD is itself a sign the project is being scrutinized by outside researchers, which is a healthier sign than no CVEs at all for a tool with this much system access.

None of this is reason to treat Kilo Code as uniquely unsafe among AI coding agents — the Metabase incident involved internal tooling common to many SaaS companies, and CVEs get filed against actively-used software, including Kilo's direct competitors. But Slack token exposure specifically is a real, concrete consequence for any Slackbot-connected user, not an abstract risk, and anyone using that integration should check whether they were notified and rotate credentials if there's any doubt.

Kilo Code's core value proposition is genuinely hard to argue with on paper: free software, zero-markup inference pricing, and access to more models than almost any competitor in this category offers. For a developer who wants to try five different models on the same task without committing to one lab's ecosystem, that breadth is a real, practical advantage — not a marketing checkbox.

The Anaconda acquisition is worth taking seriously as a maturity signal rather than dismissing as corporate noise. A well-capitalized data-science company buying an open-source coding agent outright, explicitly to anchor a broader AI development strategy, is a meaningfully different trajectory than a small team maintaining a project on donated time. Whether that translates into faster security response and more consistent long-term support remains to be proven, but it's a reasonable basis for more confidence than the project had a year earlier.

The Metabase incident deserves a direct, un-softened assessment rather than a glossed-over mention. Exposing user prompts and Slack access tokens, even for a subset of users, is a real consequence with a real fix required on the affected users' end — rotating any potentially exposed Slack tokens isn't optional caution, it's the correct response to this specific disclosure. Anaconda's own public writeup is detailed and dated, which is the right way to handle a disclosure like this, and that transparency should factor into the assessment alongside the fact that the incident happened in the first place.

The infinite-loop and settings-persistence bugs documented on GitHub are a smaller concern individually, but they paint a consistent picture worth naming: Kilo Code, like most agentic coding tools racing to ship features in 2026, has rough edges that show up in real usage, not just edge-case lab conditions. An $7.59 token-burn incident is a minor financial loss on its own; it's evidence of a pattern that could cost considerably more under worse conditions, and that's the lens worth applying rather than dismissing it by its dollar amount alone.

Set against Cline specifically — its closest open-source peer — Kilo Code trades a somewhat rockier recent track record for genuinely broader model access and cloud agent capability. Neither tool is simply "better." A developer prioritizing the widest possible model selection and willing to actively manage the risks documented here has real reasons to choose Kilo. A developer who weighs a cleaner incident history more heavily has equally real reasons to lean toward Cline instead. This review's job is to make both of those reasons visible, not to flatten them into a single winner.