Cline Data Exfiltration via Indirect Prompt Injection
Date: 2025-08
Affected: Cline
Attack vector: data-exfiltration
Category: research
Severity: High

Cline coding agent vulnerable to indirect prompt injection leading to data exfiltration. Reported May 29, 2025; disclosed publicly after 90+ day window.


Mitigations:

Architectural layers (MAESTRO):