Cline is one of the most widely adopted open-source AI coding agents . Developers trust it with deep access to their environments: source code, terminals, git repositories, cloud credentials, and, increasingly, agent autonomy that lets it act on their behalf without per-step confirmation.
That trust comes with a critical assumption: only the developer, through Cline's own UI, can communicate with the agent.
Oasis Security researchers found a critical vulnerability (CVSS 9.7) in Cline’s local kanban server. Any website a developer visited while running an affected version could silently connect to their machine, exfiltrate workspace data in real time, and inject commands into the developer's AI agent. The developer would see nothing unusual. They were just browsing the web.
We reported the finding to Cline before publication. The vulnerability has been fixed in version [0.1.66]. Read the full technical report here.
The kanban server opens a WebSocket listener on the developer's machine for real-time communication between the management UI and AI agent sessions. The problem is that it accepts connections from anywhere. There is no origin check, no authentication token, and no verification that the connecting client is actually the Kanban UI. Any JavaScript running in the developer's browser can reach it.
WebSockets sit in a well-known blind spot in browser security. Unlike standard HTTP requests, they are not subject to the same-origin policy restrictions enforced by CORS. A page served from any domain on the internet can open a WebSocket connection to localhost, and the browser will allow it. The kanban server, not expecting visitors from the outside, lets them right in.
That single missing check exposes three capabilities to an attacker.
The attack surface is broad. Every developer running Cline's kanban feature is reachable from any webpage they visit. No phishing, no social engineering, no malware install. Just a bit of JavaScript on a page the developer happens to open.
AI agents hold credentials, access source code, and execute commands autonomously. The trust boundary between a developer's browser and their local agent infrastructure is thinner than most organizations realize, and as this research demonstrates, it can be crossed from any webpage on the internet.
Traditional identity and access management were not built for this. Organizations need purpose-built controls: intent analysis that distinguishes legitimate agent actions from injected commands, deterministic policy enforcement, just-in-time-scoped credentials, and a full audit trail from the human to the agent to the action. This is the problem Oasis Security's Agentic Access Management platform was built to solve.
For the full technical breakdown, read the Cline kanban whitepaper here .
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
