Cline — agentic threat model

Not certain from the listing — Cline is model-agnostic and connects to external LLM providers via APIs. This introduces risks of prompt injection, where malicious instructions in a codebase could hijack the model's behavior during file reading.

Cline operates directly on the local workspace and codebase. The primary threat is data exfiltration of proprietary source code or sensitive configuration files if the agent is compromised via prompt injection.

Features a dual Plan/Act framework with tool-calling capabilities (file editing, terminal execution, MCP). Insecure tool integration or lack of strict input validation on terminal commands represents a critical vulnerability.

Runs locally as a VS Code extension. It inherits the user's local system privileges, meaning any command execution occurs directly on the host machine, risking host compromise and lateral network movement.

Not certain from the listing — While the user can observe actions in the VS Code UI, there is no mention of automated guardrails, policy enforcement, or centralized security logging to detect anomalous agent behavior.

Not certain from the listing — As an open-source local extension, it lacks centralized enterprise compliance controls, identity management, or audit trails, relying entirely on the developer's local security posture.

Utilizes the Model Context Protocol (MCP) to extend capabilities. This introduces ecosystem risks where a compromised or malicious third-party MCP server could execute unauthorized actions or inject malicious payloads.