Top all-time · #6352
Adnan Khan
Personal blog · adnanthekhan.comsecurityprogramming
Adnan Khan's personal blog at adnanthekhan.com covers security and programming. Since 2024, 13 different Hacker News readers have linked it 13 times, most often “Clinejection: Compromising Cline's prod releases by prompting the issue triager”. It is still writing: the last post was on 2026-03-03, and you can follow it by feed.
Too few sampled comments (6) to say how often HN recommends it.?
Why HN links it
HN readers link Adnan Khan's posts as the primary writeups of GitHub Actions and supply-chain attacks, including the 'Clinejection' prompt-injection issue-title attack and a PyTorch supply-chain attack.
Summarised by Claude from a sample of 6 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Security research blog focusing on CI/CD security, software supply chain attacks, and developer tooling vulnerabilities.
Most-linked posts?
- Clinejection: Compromising Cline's prod releases by prompting the issue triager6 people · 6 mentions · first linked 2026-02-18
- One Supply Chain Attack to Rule Them All2 people · 2 mentions · first linked 2024-01-14
What Hacker News says?
Yeah, the security posture of that repository is kind of a mess (which is why something like https://adnanthekhan.com/2023/12/20/one-supply-chain-attack-... was even possible in the first place). The balance there is overwhelmingly in favor of usability and having new tools (hence the 1 week deployment cadence). Maybe there is some process they have to go over everything before it makes it into the production pool,…
Comment linking /2023/12/20/one-supply-chain-attack-to-rule-them-all/
on “A supply chain attack on PyTorch”Submitted An Obscure Actions Workflow Vulnerability in Google's Flank as a story · 20 points
HN discussionThe original report by the developer, Khan, mentions that github:cline/cline would also work[0]. > github:cline/cline#aaaaaaaa could point to a commit in a fork with a replaced package.json containing a malicious preinstall script. [0] https://adnanthekhan.com/posts/clinejection/#the-prompt-inje...
Comment linking /posts/clinejection/
on “A GitHub Issue Title Compromised 4k Developer Machines”Submitted Who's SHA Is It Anyway: Bypassing Google Cloud Build Comment Control for $30k as a story · 3 points
HN discussionSource: https://adnanthekhan.com/posts/clinejection/
Comment linking /posts/clinejection/
on “A GitHub Issue Title Compromised 4k Developer Machines”Submitted Cacheract: The Monster in Your Build Cache as a story · 3 points
HN discussionThis article only rehashes primary sources that have already been submitted to HN (including the original researcher’s). The story itself is almost a month old now, and this article reveals nothing new. The researcher who first reported the vuln has their writeup at https://adnanthekhan.com/posts/clinejection/ Previous HN discussions of the orginal source: https://news.ycombinator.com/item?id=47064933 https://news.y…
Comment linking /posts/clinejection/
on “A GitHub Issue Title Compromised 4k Developer Machines”Submitted Compromising Cline's Production Releases Just by Prompting an Issue Triager as a story · 1 points
HN discussionHi HN, I'm Eliad. This year, a GitHub Issue title prompt-injected an AI coding agent into running malicious code against 5M installations. https://adnanthekhan.com/posts/clinejection/ Every AI agent that reads untrusted input (webpages, files, tool outputs, github issue titles) has this problem. Models cannot distinguish instruction from data and i wanted to build an innovative solution to that problem. The current…
Comment linking /posts/clinejection/
on “Show HN: LLMSecure – prompt injection detection, no signup”Submitted Clinejection: Compromising Cline's prod releases by prompting the issue triager as a story · 1 points
HN discussionGithub actions has had a bunch of high-profile prompt injection attacks at this point, most recently the cline one: https://adnanthekhan.com/posts/clinejection/ I guess you could argue that github wasn't vulnerable in this case, but rather the author of the action, but it seems like it at least rhymes with what you're looking for.
Comment linking /posts/clinejection/
on “AI Agent Hacks McKinsey”Submitted RoguePuppet – A Critical Puppet Forge Supply Chain Vulnerability as a story · 1 points
HN discussionSubmitted One Supply Chain Attack to Rule Them All as a story · 1 points
HN discussion
