Cline (open-source)

Citation check incomplete — recheck later.

Summary

Cline is an open-source coding agent that runs in VS Code, JetBrains IDEs or a terminal with a language model chosen by the user, and asks for approval before actions unless auto-approval is turned on. Twenty independent studies that ran it were found (eight peer-reviewed), most from 2026; thirteen are security studies. In task studies it was close to other harnesses with the same models in some settings (similar completion to OpenCode with GPT-5.3-Codex on ANCHOR; the highest success rate among assistants on GitChameleon 2.0 without a problem statement) and lower in others (31.2% against 37.8% for Claude Code on SWE-Nexus; 8.66% against 14.20% on SpreadsheetBench 2). Security studies found prompt injection, tool poisoning and malicious repositories leading to command execution in many configurations, often with auto-approval on; with approval required, one study found none of seven skill-file vulnerabilities still exploitable. Two high or critical CVEs in companion servers of the command-line tool have fixes in code, and independent researchers reported slow responses to several security reports in 2025 and early 2026. Informational only; not a guarantee, endorsement, or certification.

Overall score: 55 · Evidence grade: A · Independent sources: 20 performance (8 peer-reviewed), 22 other

Evidence grade describes the amount and type of evidence, not the agent's quality.

Grade note: Grade A: 20 counted sources (8 peer-reviewed), and recent tests state the version tested: Red-Teaming Coding Agents (FSE 2026, Cline v3.82.0), Can Agents Trust Their Skills? (Cline CLI 3.0.47), What's in Your Agent's Context? (3.77.0) and Beware of Agentic Botnets (3.66.0). No counted test states a v4.x extension version. Results reflect the model and harness together (see Decision 0087, D3). (see methodology)

Factor breakdown

0.30 × 50 + 0.20 × 45 + 0.25 × 40 + 0.25 × 85 = 55.25, rounded to 55 (rounding rule).

Scope

The open-source Cline agent from the cline/cline repository, run with a language model chosen by the user: the VS Code extension (v3.x through v4.1.25, 16 October 2026), the JetBrains plugin and the Cline command-line tool (through 3.0.73, 17 October 2026), including its use in GitHub Actions workflows. Companion servers started by the command-line tool (Kanban, Hub dashboard) are covered under disputes. Forks such as Roo Code and Kilo Code are separate products; their results are not counted here, even when reported in the same studies. Results depend heavily on the language model, the approval settings and the task.

How sources were counted

The Cline repository, documentation, blog, post-mortem and the cline-bench benchmark are the developers' own material and are not counted. Studies by independent authors that run unmodified Cline count, with competing or add-on methods disclosed; most compare it with other harnesses using the same models, and some use it as a fixed host to compare attacks or models. Results for forks (Roo Code, Kilo Code), agents built on Cline, studies of its prompt text or source code, and re-analyses of reports by others are listed as other or not counted. Security advisories and researcher write-ups are listed as other and inform the disputes factor.

Security and disputes

CVE-2026-44211 (GitHub advisory, 8 May 2026; CVSS 3.1 score 9.6, Critical; NVD status Analyzed) describes the Kanban server started by Cline CLI 2.13.0 and earlier accepting cross-origin WebSocket connections, so a website could read workspace data and send commands to agent terminals. The advisory and NVD list no patched version; an origin and host check was merged in the cline/kanban repository on 27 April 2026 and is in the kanban package from version 0.1.66 (27 April 2026). CVE-2026-59723 (GitHub advisory, 23 June 2026; CVSS 3.1 score 8.8, High; NVD status Analyzed) describes the Hub dashboard started by 'cline dashboard' accepting cross-origin connections and auto-approving tools in its sessions; NVD lists versions before CLI 3.0.30 (26 June 2026) as affected. On 17 February 2026 a leaked npm token was used to publish an unauthorized Cline CLI release (2.3.0) that installed an unrelated package; 2.4.0 replaced it about 8 hours later, and the VS Code and JetBrains extensions were not affected (GHSA-9ppg-jx86-fqw7, Low). The token had been exposed through a prompt-injection flaw in the project's own GitHub issue-triage workflow, reported privately on 1 January 2026 and addressed after public disclosure on 9 February 2026. Independent researchers also reported slow or no responses to security reports in 2025. No legal or regulatory action was found.

Uncertainties

• Results reflect the model and the harness together; Cline is run with many different models.
• Thirteen of the 20 counted studies are security studies, so evidence on everyday task completion is thinner than the source count suggests.
• Most counted studies do not state the Cline version; the VS Code extension moved to v4.0.0 on 26 June 2026, and no counted study states a v4.x version.
• The CVE-2026-44211 advisory and NVD list no patched version; the fix date is inferred from cline/kanban pull request #421 and the kanban 0.1.66 package.
• Several 2025 security reports (Embrace The Red, IDEsaster) have no confirmed fix status for Cline.
• Two pairs of counted studies share authors (SWE-Nexus and ANCHOR; Red-Teaming Coding Agents and Parasites in the Toolchain).
• Several figures were read from tables in extracted text or PDF layouts.
• Results for forks (Roo Code, Kilo Code) are not counted, even when reported in the same studies.
• Citation check incomplete — recheck later (OpenAlex full text used: 790 works matched and 295 downloaded; Semantic Scholar rate-limited).

Sources

Independent performance sources (counted)

• Red-Teaming Coding Agents from a Tool-Invocation Perspective (HKUST, Fudan; Proceedings of the ACM on Software Engineering, FSE 2026): six coding agents including Cline v3.20.8 (older models) and v3.82.0 (newer models); the authors' two-channel tool-hijacking attack (RCE-2) reached 1.0 success on Cline with Grok-4, Sonnet-4 and Sonnet-4.5, and on v3.82.0 still reached 1.0 with Gemini-3.1-pro and Grok-4.20. The authors credit Cline's system prompt with restricting commands from external sources, and report that 'Cline's default configuration lacks these safeguards' (command allowlisting or confirmation of high-risk tool calls). Table figures read from extracted text. Shares an author with Parasites in the Toolchain (counted) — accessed 2026-10-20
• A First Look at the Security Issues in the Model Context Protocol Ecosystem (University of Delaware; DSN 2026): four MCP hosts (Cursor, Windsurf, Claude Desktop, Cline) with several models; none of the hosts, Cline included, verified that a tool the model selected came from the intended server, and context-dangling and tool-confusion success rates are reported for each host and model. By default, 'all hosts except Cline display concise summaries' of tool calls, so Cline showed full details — accessed 2026-10-20
• Parasites in the Toolchain (Shanghai Jiao Tong, HKUST, Chaitin Technology; IEEE S&P 2026): attack success of malicious MCP tool chains across six clients (Cursor, VS Code, Cline, Cherry Studio, Claude Code, Codex) and several models; Cline was compromised in most trials with most models (often 3 to 5 of 5 per prompt; table read from extracted text). Disclosure: one author is at a security company; one author also wrote Red-Teaming Coding Agents (counted) — accessed 2026-10-20
• Model Context Protocol Threat Modeling and Analysis of Vulnerabilities to Prompt Injection with Tool Poisoning (New York Institute of Technology; Journal of Cybersecurity and Privacy, 2026; preprints arXiv 2603.21642 and 2603.22489 counted once): seven MCP clients, Cline 3.34.0 with Claude Sonnet 4.5; Cline, Claude Desktop and Continue 'successfully blocked file access through model-level refusals', while Cursor read sensitive files; but 'Cursor and Cline are unsafe and execute remote scripts when instructed', despite basic domain filtering — accessed 2026-10-20
• MPMA: Preference Manipulation Attack Against Model Context Protocol (AAAI-26): 'All the experiments are conducted using Cline'; manipulated server names and descriptions raised the probability that the model chose the attacker's MCP server. Cline is used as a fixed host to compare attacks and models — accessed 2026-10-20
• GitChameleon 2.0 (ELLIS Institute Tübingen, Mila, Google, ServiceNow and others; ACL 2026): version-specific Python coding tasks; without the problem statement, Cline with GPT-4.1 had the highest success rate among the CLI and IDE assistants tested (38.4%); assistants other than Goose with GPT-4o gained 12 to 35 points when the problem statement was given. Disclosure: authors at Google and ServiceNow — accessed 2026-10-20
• Zoro (Columbia University; accepted at UIST '26, November 2026; the DOI printed in the paper was not yet registered on 20 October 2026): 'We used Cline as the coding agent with Claude Sonnet 4.6 as the model for our technical evaluation', one run per task; without the authors' add-on, rule following was 51% (process rules 35%, coding rules 59%), and 80% with it (87% and 75%). Authors propose an add-on method (disclosed) — accessed 2026-10-20
• Automatically Attacking Software Reverse Engineering AI Agents (Naval Postgraduate School; ECCWS 2026): adversarial strings compiled into C programs made a Cline + GhidraMCP pipeline with Qwen3-8B describe a program's function incorrectly. Cline is used as a fixed harness; the attack targets the model's analysis (see D3) — accessed 2026-10-20
• What's in Your Agent's Context? Context Privilege Escalation Attacks against AI Agent Harness (UIUC; preprint, September 2026): 12 agent harnesses including Cline 3.77.0; Cline loads a listing of working-directory file names into context and acts on tool tags in model output, which the authors used in an end-to-end attack that made Cline write attacker instructions into another agent's rules file (.windsurfrules). The authors report that Codex, Gemini CLI and Cline 'have released new versions to mitigate the threats we reported' — accessed 2026-10-20
• Beware of Agentic Botnets (Tel Aviv University, Technion, Intuit; preprint, July 2026): hallucinated-repository squatting against coding assistants; asked to clone a repository, Cline 3.66.0 with KAT-Coder-Pro V1 invoked the attacker's repository in 11 of 20 trials and ran the payload in 9 of 20 (45%); across the tools tested, code execution occurred in 20% to 65% of evaluations. Disclosure: one author is at Intuit — accessed 2026-10-20
• ShareLock (Shanghai Jiao Tong University; preprint, June 2026): a multi-tool MCP poisoning attack tested on Cherry Studio v1.5.11 and Cline v3.35.0 with four models; average attack success above 90% on both clients — accessed 2026-10-20
• Can Agents Trust Their Skills? (Chinese Academy of Sciences, Worcester Polytechnic Institute; preprint, September 2026): 11 open-source agents that load skill files, run in permissive non-interactive modes (Cline CLI 3.0.47 with --auto-approve true); 7 vulnerabilities were verified in Cline (24 in the agent with the most; 104 in total), 2 of the 7 reproduced when the skill text was given as a plain prompt, and none of the 7 remained exploitable with --auto-approve false. Table columns read from the PDF layout — accessed 2026-10-20
• Safe to Resume? (Southern University of Science and Technology, City University of Hong Kong; preprint, August 2026): rollback and recovery failures in agent frameworks, with three end-to-end attacks, one on Cline, where resuming after a checkpoint rollback led to unauthorized mail forwarding — accessed 2026-10-20
• GitInject (Virginia Tech, AI Sequrity Company; preprint, June 2026): prompt injection against AI agents in GitHub Actions workflows; a Cline assistant workflow triggered by any comment containing @cline, with no author restriction, followed an issue body 'framed as a routine diagnostic request' and posted the owner's private repository names in its public reply — accessed 2026-10-20
• Package Hallucination Attacks on Coding Agents through Prompt Injection in Rule Files (Duke University; preprint, October 2026): eight agent frameworks 'configured in their autonomous modes, in which manual confirmation steps are disabled'; the authors' rule-file attack, optimized on OpenHands, transferred to Cline with Qwen3-Coder-30B, with per-package success rates reported alongside the other frameworks — accessed 2026-10-20
• SWE-Nexus (National University of Singapore, Shanghai AI Laboratory, Tsinghua, independent researchers; preprint, October 2026): 600 tasks, 12 models under Claude Code, Cline and OpenCode; the highest resolved rate under each scaffold was 37.8% under Claude Code and 29.7% under OpenCode (both Claude Opus 4.8), and 31.2% under Cline (GPT-5.5 and GPT-5.4, tied). Shares several authors with ANCHOR (counted) — accessed 2026-10-20
• ANCHOR (Southern University of Science and Technology, Nanjing University, NUS, independent researchers; preprint, October 2026): 358 constrained repository tasks, 19 configurations across Cline and OpenCode; Claude Opus 4.8 under Cline had the highest compliance measured (70.1% atomic, 19.0% of tasks passing every item, 43.6% constrained completion); with GPT-5.3-Codex, constrained completion was 37.7% in Cline and 37.4% in OpenCode, but item pass rate 62.9% against 67.9%. Shares several authors with SWE-Nexus (counted) — accessed 2026-10-20
• SpreadsheetBench 2 (Renmin University and industry co-authors; preprint, June 2026): GLM-5 under four scaffolds on business spreadsheet workflows; Cline scored 41.98 on modification and 8.66% accuracy, against 43.47 and 14.20% for Claude Code and 46.32 and 15.45% for the authors' scaffold (Kilo Code 8.66%). Authors propose a competing scaffold (disclosed) — accessed 2026-10-20
• Beyond Generalist LLMs (Commonwealth Bank of Australia; workshop paper, SCALE at ICML 2026): Cline and Roo Code as baselines for generating workflow agents; Cline and the authors' system each needed 117 attempts for 100 working agents (85.5%; Roo Code 73.0%), and Cline used about 1,044 thousand tokens against about 55 thousand for the authors' pipeline. Authors propose a competing method (disclosed) — accessed 2026-10-20
• DeepDiscovery (Alibaba AMAP, NTU, Nanjing University, Cambridge; preprint, June 2026): six coding systems locating task-relevant files in industrial repositories with Claude Sonnet 4.5; native Cline recovered the full file set in 72.5% of large-project tasks (Cursor, OpenCode and Qoder 82.5%) and 79.0% of medium ones, rising to 81.7% and 86.4% with the authors' add-on. Authors propose an add-on method (disclosed). Disclosure: Alibaba makes a competing coding agent (Qoder) — accessed 2026-10-20

Other sources (not counted)

• AutoData (Notre Dame, IBM and others; NeurIPS 2025): reports 'data collection by human efforts, via Cline' and Cursor as reference points for open-web data collection (about 83 minutes with Cline against about 187 for unaided manual collection; table read from extracted text). Human-directed use, not an autonomous run, so listed as other (see D3) — accessed 2026-10-20
• Inside the Scaffold (preprint, April 2026): source-code taxonomy of 13 coding agents; 'Cline's recursive implementation is the only instance of recursion for the main agent loop in the corpus'. Code analysis, not a run of the agent — accessed 2026-10-20
• Configuration, Not Conscience (University of Piraeus; preprint, September 2026): analysis of 407 system prompts; 'RooCode has 54% of its word 5grams contained in Cline'. Text analysis, not a run — accessed 2026-10-20
• AISPA (preprint, July 2026): audit of system prompts of LLM applications, including Cline's (39.5 protective entries on average). Text analysis, not a run — accessed 2026-10-20
• HarnessSecurity-Bench (Sun Yat-sen University and others; preprint, October 2026): rates ten security mechanisms across 40 harnesses from documentation and source code, including Cline; Cline was not among the six harnesses run in its experiments — accessed 2026-10-20
• Don't Let AI Agents YOLO Your Files (SOSP '26): 207 filesystem incidents and exploits from public reports, including several Cline GitHub issues; Cline was not run. Re-analysis of reports by others (0076) — accessed 2026-10-20
• 'Impossible to hide secret ...' (preprint, July 2026): security and privacy issues mined from developer posts about LLM-native IDEs, some about Cline. Re-analysis of reports by others (0076) — accessed 2026-10-20
• AgentPulse (preprint, April 2026): composite of benchmark figures, adoption and sentiment signals for deployed agents, including Cline, using results reported by others. Re-analysis (0076) — accessed 2026-10-20
• 'I'm Not Reading All of That' (Samsung; preprint, March 2026): small formative study of software engineers' cognitive engagement while using Cline; measures the users, not the agent's results — accessed 2026-10-20
• AIPC (Qualcomm; technical report, April 2026): an automated model-deployment workflow run with coding agents including Cline, single runs, framed as a comparison of models and agents in one company workflow (0039 context; see D3) — accessed 2026-10-20
• ZhuLong (Changxin Memory Technologies; preprint, August 2026): an EDA scripting agent built on Cline CLI with added tools; results describe the derived agent (0042) — accessed 2026-10-20
• FLARE (preprint, September 2026): evaluates a reward model with 'Cline-style' scaffolds; whether unmodified Cline was run is not stated (0042). Shares authors with SWE-Nexus and ANCHOR — accessed 2026-10-20
• Projecting the Emerging Mindset of SWE Agent (Tongji University; preprint, June 2026): uses a Cline-style prompt within the authors' own setup, not unmodified Cline (0042) — accessed 2026-10-20
• Mindgard (security company blog, November 2025): four issues reported to Cline on 27 August 2025, including prompt injection in source files leading to key exfiltration through a command that needed no approval, and .clinerules files that turned off command approval; 'These issues were re-tested on Oct 31, 2025 on Cline v3.35.0' and appeared mitigated. Mindgard reports that the vendor did not respond to repeated requests about the changes — accessed 2026-10-20
• Embrace The Red (independent researcher, 2025): prompt injection could make Cline exfiltrate .env contents through a rendered image URL without approval; reported 29 May 2025 and, per the author, unaddressed after more than 90 days. Current fix status not determined — accessed 2026-10-20
• IDEsaster (independent researcher, 6 December 2025): an attack class chaining prompt injection, auto-approved tool calls and IDE features; Cline is listed among affected products. Cline-specific fix status not determined — accessed 2026-10-20
• Clinejection (independent researcher, February 2026): prompt injection in Cline's own GitHub issue-triage workflow (which ran Claude Code) could poison the Actions cache and expose release credentials; reported 1 January 2026 and addressed after public disclosure on 9 February 2026. Concerns the project's release process, not the agent's behaviour — accessed 2026-10-20
• CVE-2026-44211 (GitHub advisory 8 May 2026; CVSS 3.1 9.6 Critical; NVD Analyzed): the Kanban server started by the Cline CLI (2.13.0 and earlier) accepted cross-origin WebSocket connections, letting a website read workspace data and inject commands into agent terminals. The advisory lists no patched version; an origin and host check was merged in cline/kanban pull request #421 on 27 April 2026 and is present in the kanban package from 0.1.66 (27 April 2026) — accessed 2026-10-20
• CVE-2026-59723 (GitHub advisory 23 June 2026; CVSS 3.1 8.8 High; NVD Analyzed): the Cline Hub dashboard started by 'cline dashboard' accepted cross-origin WebSocket connections without a secret by default, and its sessions auto-approved tools; NVD lists versions before CLI 3.0.30 (26 June 2026) as affected, with the fix commit and release referenced — accessed 2026-10-20
• GHSA-9ppg-jx86-fqw7 (Low; 17 February 2026): a leaked npm token was used to publish Cline CLI 2.3.0 with an added install script for an unrelated package; 2.4.0 was published and 2.3.0 deprecated about 8 hours later, and publishing moved to OIDC provenance. The token had remained active after the Clinejection disclosure because the wrong token was revoked (Cline post-mortem) — accessed 2026-10-20
• GitHub issue #5124 (closed, July 2025): a user reports Cline deleting files without tracking them; single user report — accessed 2026-10-20
• GitHub issue #8422 (closed, opened January 2026): a user reports Cline overwriting a whole .env file when asked to add one variable; single user report — accessed 2026-10-20

Not counted

• GitHub repository, README and documentation (Apache-2.0; created 6 July 2024; VS Code extension v4.1.25 of 16 October 2026, CLI 3.0.73 of 17 October 2026): developer descriptions and claims. Not counted — accessed 2026-10-20
• Cline post-mortem of the February 2026 unauthorized npm publish (23 February 2026): developer account of the incident and changes. Not counted — accessed 2026-10-20
• cline-bench (announced by Cline on 20 November 2025): a benchmark built from Cline user sessions by the Cline team. Developer-run material, excluded under 0031 — accessed 2026-10-20
• Results for a language model alone, and results for forks of Cline (out of scope).

Decision record: 0087.