A hacker exploited Cline, a popular AI coding assistant, using a prompt injection vulnerability in Anthropic's Claude to force-install OpenClaw across developer systems, according to The Verge
Security researcher Adnan Khan had revealed the vulnerability just days earlier in a proof-of-concept post , demonstrating how Claude could be fed hidden instructions
The attack highlights fundamental security risks as autonomous AI agents gain system-level access and the ability to execute code without human oversight
This incident marks one of the first real-world exploitations of prompt injection attacks against AI coding tools with actual system permissions
A hacker just exposed the dirty secret AI coding assistants - they're dangerously easy to hijack. The attacker exploited a critical vulnerability in Cline, a popular open-source AI coding tool used by thousands of developers, to mass-install OpenClaw, the viral autonomous AI agent, across user systems. The incident, which leveraged Anthropic's Claude through a prompt injection technique, isn't just a clever prank. It's a stark warning what happens when we hand autonomous AI agents the keys to our computers.
Cline , an open-source AI coding agent that's become a favorite among developers for automating mundane programming tasks, just got weaponized. A hacker managed to trick the tool into installing OpenClaw - the viral, somewhat chaotic AI agent that "actually does things" - on systems across the developer community. What started as a security researcher's warning shot became a live demonstration of AI's most pressing vulnerability.
The exploit centers on a technique called prompt injection, and it's deceptively simple. Cline operates by interfacing with Anthropic's Claude , the large language model that powers its coding decisions. Security researcher Adnan Khan discovered that malicious actors could embed hidden instructions in code repositories, documentation, or even API responses that Claude would dutifully follow. When Cline scanned these sources, it didn't just read the code - it absorbed the poisoned instructions and executed them as if they were legitimate user commands.
Khan published his findings in a detailed proof-of-concept just days before the attack went live. His post laid bare how trivial it was to manipulate Cline's workflow. The problem isn't unique to Cline or Claude. It's baked into how modern AI agents interact with the world. These systems are designed to be helpful, to interpret context, to act autonomously. But that same flexibility becomes a liability when they can't distinguish between legitimate instructions and malicious commands cleverly disguised in training data or web content.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
