Clinejection: A GitHub Issue Title Compromised 4,000 Developer Machines

Simon Willison published his analysis of the Clinejection attack chain today, and it's the most important security story of the week. The attack: a prompt injection in a GitHub issue title tricked Cline's AI triage bot (running claude-code-action@v1 with Bash/Read/Write tools) into running npm install from an attacker-controlled commit. The malicious preinstall script deployed Cacheract, flooded the Actions cache with 10+ GB to trigger LRU eviction, and planted poisoned entries matching the nightly release workflow's keys. Eight days after disclosure, an unknown actor used the same flaw to publish [redacted] with OpenClaw bundled, affecting ~4,000 developer machines during an 8-hour window. The lesson: any CI/CD pipeline that gives an AI agent tool-execution permissions on untrusted input is a supply chain attack surface. (Simon Willison | Snyk)