TL;DR: Two high-severity code-execution paths in Cline can let attacker-controlled repo content trick the AI coding agent into running shell commands under a developer’s account, exposing credentials, source code, and VPN-reachable systems, according to Manifold Security research. The failure is assumption collapse: approval gates and safe-command checks cannot rely on the agent or the clicked URL as trustworthy control inputs.
At a glance
What this is: This analysis shows how Cline’s URL preview and Safe Commands controls can be bypassed to trigger shell execution from attacker-controlled repository content.
Why it matters: It matters because agentic coding tools inherit developer privileges, so a single prompt can turn repository content into credential exposure, source code access, and broader lateral reach.
Context
Agentic coding tools create a control problem that looks familiar but behaves differently at runtime: the system is not just executing developer intent, it is interpreting untrusted repository content and then acting with the developer’s privileges. In this case, the primary issue is not code generation quality but whether approval boundaries still mean anything when the agent itself can be steered by attacker-controlled text.
The governance gap is a trust boundary collapse between what the interface suggests is being checked and what the runtime actually executes. A developer who believes they are reviewing a destination or allowing a harmless command may in fact be handing execution to content embedded in a repo, issue, webpage, or MCP response.
Key questions
Q: What breaks when an AI coding editor can execute commands directly?
A: The control model breaks because command execution moves from human review to machine action. That creates a runtime identity problem: the editor can turn a suggestion into a shell command, file write, or tool call before a person has time to judge whether it is safe. Governance has to cover execution authority, not only code output.
Q: Why do AI coding agents create confused-deputy risk in developer workflows?
A: Because they execute under the developer’s identity while reading attacker-controlled instructions from repositories, issues, or web content. The agent becomes the deputy that can be tricked into acting for the wrong principal. That means a normal setup task can become privileged local execution unless repository content is treated as hostile by default.
Q: What signs suggest an agentic approval flow is not actually controlling execution?
A: If a preview action can trigger a shell, if the model can mark its own command safe, or if the same workflow succeeds with no meaningful human gate, the control is cosmetic. Those are signs that the interface and the runtime boundary are misaligned, which is exactly where agentic abuse starts.
Q: Should organisations treat AI coding agents like privileged software identities?
A: Yes. If an AI agent can install code, access secrets, or modify repositories, it is functionally acting as a privileged non-human identity and should be governed that way. That means task-scoped access, explicit boundaries, and monitoring of its downstream actions, especially when it can touch build and release systems.
Technical breakdown
How a URL preview becomes a shell execution path
The first flaw sits in the UI to execution chain. A URL preview tile should be a passive inspection surface, but here the click handler forwards the URL into an OS command wrapper. That means the preview action is not isolated from execution, and shell metacharacters can escape the wrapper into a real command. The important design mistake is not just bad sanitisation. It is treating a review affordance as if it were non-executable when the runtime path still reaches a shell sink. The Approve/Deny dialog is therefore not in control of the action it appears to govern.
Practical implication: Map every preview, inspect, and verify action to its actual sink, not its intended UI label.
Why model-declared safe commands are not a control
The second flaw is governance by self-attestation. Instead of matching a command against a fixed allowlist, the system asks the model whether its own command is safe and then trusts that answer. That is a circular trust loop: the same agent that was influenced by attacker content is now allowed to classify its own output as low risk. In agentic systems, the real control variable is not what the model says about a command, but whether the downstream interpreter will re-evaluate that command differently from the model’s intent. If the bytes can still be expanded by a shell, the approval decision is already unsafe. See the Agentic AI Security Guide.
Practical implication: Decouple command approval from model self-reporting and validate the argument string before execution.
The shared-responsibility model breaks at the moment of delegation
The broader architectural lesson is that delegation is not the same as containment. Once the coding agent inherits the developer’s environment, any attacker influence over repository content can become execution under that identity. This is why agentic tooling creates a confused-deputy condition: the user delegates setup work, but the agent can be induced to act on instructions that were never intended to be trusted. The problem is not limited to one extension. Any agent that can read untrusted text and then invoke local tools without hard execution boundaries can be turned into a privilege relay. Read AI Agents vs Agentic AI.
Practical implication: Treat repository-driven setup flows as delegated execution paths and constrain what the agent can launch from them.
Threat narrative
Attacker objective: The attacker’s objective is to convert ordinary repo setup into arbitrary code execution under a developer identity and use that access to reach credentials and internal systems.
- Entry occurs when a developer opens an attacker-controlled repository and asks the coding agent to set it up, giving the agent untrusted instructions to process under a normal workflow.
- Credential exposure follows when the agent runs shell commands under the developer’s account, which can access SSH keys, cloud credentials, source code, and VPN-reachable systems.
- Impact is achieved when attacker-supplied command content or URL handling causes arbitrary code execution without a meaningful approval gate, turning the agent into a privilege relay.
Breaches seen in the wild
- tj-actions/changed-files compromise 2025: A stolen bot token let attackers poison tj-actions/changed-files so pipelines printed their CI/CD secrets to public logs (CVE-2025-30066).
- EmeraldWhale Git config credential theft: Tokens in exposed .git/config files let EMERALDWHALE clone private repositories and steal more than 15,000 cloud credentials.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Approval gates that depend on the agent’s own judgment are not controls, they are acknowledgements. When the same runtime that consumes attacker-controlled text also decides whether its own command is safe, the approval model has already failed. This is not a tuning problem. It is a trust-placement problem, and practitioners should stop treating model self-attestation as a governance boundary.
Identity in agentic coding tools is delegated execution, not just user authentication. The developer identity is being exercised by a system that reads untrusted content and then invokes local tools on the user’s behalf. That means the security question is not simply who logged in, but which runtime is allowed to transform untrusted instructions into privileged local action.
URL preview and command approval are both examples of runtime trust debt. The control appears to exist at design time, but the actual execution path is different from the path users think they are validating. The implication is that agentic programmes must measure the distance between interface intent and execution sink, because that distance is where compromise emerges.
Indirect prompt injection is now an operational identity issue, not just a model-safety issue. The article’s own disclosure discussion shows how repo content, issue text, and even web content can become the instruction source for privileged actions. That widens the problem from prompt hygiene to governance over what content is allowed to influence local execution.
From our research library:
- Internal repositories are 6x more likely to contain secrets than public ones (32.2% vs 5.6%), contradicting the assumption that private repos are safe, according to the State of Secrets Sprawl 2026.
- A Harris Poll survey of more than 300 technology decision-makers found that 86% expect agentic AI to deliver positive ROI, yet fewer than half had AI governance policies in place.
- Read next: MCP Security Guide
What this signals
Trust boundary collapse: agentic coding tools fail when the user interface, the model decision, and the shell interpreter are allowed to disagree about what is safe. That mismatch means governance has to move from approval prompts to execution-time validation, because the relevant control point is the interpreter, not the conversation.
The operational signal for practitioners is that local developer agents should be assessed like privilege-bearing runtime components, not like passive assistants. Once an agent can consume repository text and launch local tools, the question becomes whether its delegated actions are bounded tightly enough that untrusted content cannot redirect them.
For practitioners
- Audit approval surfaces against the real execution sink Trace every approve, deny, preview, and inspect interaction to the underlying process it triggers, then remove any UI path that can reach a shell or interpreter unexpectedly.
- Separate model confidence from execution permission Require deterministic policy checks on the command string and its arguments before dispatch, even when the model marks the action as low risk.
- Constrain repository-driven setup flows Treat untrusted repositories as hostile inputs and limit what the agent can invoke during setup, especially when the workflow inherits developer credentials.
- Review how developer credentials are exposed to local agents Assume any command run by the coding agent can reach SSH keys, cloud tokens, browser cookies, and internal VPN resources unless explicitly blocked.
Key takeaways
- This case shows that agentic coding tools can turn ordinary repository setup into arbitrary code execution when approval gates are tied to the wrong boundary.
- The article describes two distinct failures: a preview click that reaches a shell sink and a safe-command check that trusts the model’s own judgment.
- The relevant control lesson is to validate execution strings outside the model, align UI review paths with actual sinks, and govern agent privileges like any other privileged runtime.
Related NHI Mgmt Group resources: AI Agents vs Agentic AI · Agentic AI Identity Guide · Agentic AI Security Guide · MCP Security Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI02 — Tool Misuse | The article shows an agent misusing tools through attacker-steered commands and preview actions. |
| ASI03 — Identity & Privilege Abuse | The agent acts under the developer’s identity and turns that privilege into local execution. | |
| Recommendation — Constrain tool execution paths so agent output cannot reach unsafe local commands without external policy checks. Separate delegated user identity from agent execution authority and block privilege inheritance by default. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | Approval is being granted by a model decision path that is not a trustworthy authenticator for execution safety. |
| Recommendation — Treat model self-approval as untrusted and require deterministic authentication of safe execution conditions. | ||
| NIST AI RMF | GOVERN — AI Governance and Accountability | The control failure is a governance failure over who can decide and execute under agentic workflows. |
| Recommendation — Define accountable approval authority outside the model and enforce it consistently across agent workflows. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The agent is exercising developer permissions in ways the user interface does not properly constrain. |
| Recommendation — Review entitlements so agent actions cannot exceed the permissions intended for the current task. | ||
Key terms
- Confused Deputy: A confused deputy is a privileged system that is tricked into performing an action on behalf of an untrusted requester. In agentic AI, the agent may misread malicious input as legitimate intent and then use its own authority to act, which turns a logic problem into a security incident.
- Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
- Runtime Trust Boundary: A runtime trust boundary is the point where software must stop assuming trust and start verifying identity, context, and authorization before allowing action. In identity security, it separates approved execution from untrusted inputs, external services, or delegated agents, so access decisions can be enforced at the moment a workload or AI agent acts.
- Indirect Prompt Injection: Indirect prompt injection is an attack where malicious instructions are hidden inside content that an AI system reads later. The model may treat that content as context rather than as hostile input, which can influence tool use, data access, or workflow actions if controls are weak.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org