Cline’s approval gap: are agentic controls keeping up at runtime?

TL;DR: Two high-severity code-execution paths in Cline can let attacker-controlled repo content trick the AI coding agent into running shell commands under a developer’s account, exposing credentials, source code, and VPN-reachable systems, according to Manifold Security research. The failure is assumption collapse: approval gates and safe-command checks cannot rely on the agent or the clicked URL as trustworthy control inputs.

Editorial analysis by NHI Mgmt Group, based on content published by Manifold Security: “CVE-2026-52024, CVE-2026-52025: We Bypassed Two of Cline's Safety Checks to Run Code (4.2M Installs)”.

Key questions

Q: What breaks when an AI coding editor can execute commands directly?

A: The control model breaks because command execution moves from human review to machine action.

Q: Why do AI coding agents create confused-deputy risk in developer workflows?

A: Because they execute under the developer’s identity while reading attacker-controlled instructions from repositories, issues, or web content.

Q: What signs suggest an agentic approval flow is not actually controlling execution?

A: If a preview action can trigger a shell, if the model can mark its own command safe, or if the same workflow succeeds with no meaningful human gate, the control is cosmetic.

Practitioner guidance

• Audit approval surfaces against the real execution sink Trace every approve, deny, preview, and inspect interaction to the underlying process it triggers, then remove any UI path that can reach a shell or interpreter unexpectedly.
• Separate model confidence from execution permission Require deterministic policy checks on the command string and its arguments before dispatch, even when the model marks the action as low risk.
• Constrain repository-driven setup flows Treat untrusted repositories as hostile inputs and limit what the agent can invoke during setup, especially when the workflow inherits developer credentials.

Bottom line: This case shows that agentic coding tools can turn ordinary repository setup into arbitrary code execution when approval gates are tied to the wrong boundary.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →