GuardFall: Shell Injection Bypasses Command Filters in 10 of 11 Open-Source AI Coding Agents — Cline, Aider, OpenHands, Goose, Roo-Code, Plandex, Open Interpreter, SWE-agent, opencode, and Hermes All Vulnerable

Adversa AI's GuardFall: 10 of 11 open-source AI coding agents fail shell injection via quote stripping, IFS expansion, command substitution, and Base64 payloads. Only Continue passes.

10 Open-Source AI Coding Agents (GuardFall)Tool execution / MCPShell injection bypassing AI coding agent command filters — credential theft and filesystem destructionDeveloper workstations, CI runners, and any environment where AI coding agents execute shell commands with auto-execute enabled or with configuration loaded from attacker-controlled repositories

What happened

Adversa AI surveyed 11 open-source AI coding agents using five bypass classes: quote manipulation (r''m resolves to rm), IFS expansion (rm$IFS-rf$IFS/ splits to three arguments), command substitution ($(echo rm) computes binary name dynamically), Base64 piped to shell interpreter, and destructive utility flags (find /x -delete, dd of=/dev/sda). Ten of eleven agents failed at least one class. Continue was the only agent with a correct defense.

Why it matters

Full operator-account compromise on any affected agent running with auto-execute enabled or in CI. Blast radius includes SSH keys, cloud credentials (AWS, GCP, Azure), git configuration, browser tokens, CI deploy keys, and registry credentials. In CI runners, a poisoned repository config can extract credentials from every pull request pipeline without triggering alert logic.

Missing authorization check

An external authorization gate that evaluates shell commands after bash tokenization and expansion, not before. Command-filter decisions made on pre-expansion raw strings provide false safety signals that do not reflect what bash will actually run. A pattern-matching deny-list cannot enumerate all destructive command forms and flag combinations.

Would PP block it?

GuardFall exploits the gap between what the agent's internal command filter sees and what bash executes. PP's Tool-Call Gate sits at the tool-call layer above bash — it authorizes or denies the shell command as a distinct tool call before execution reaches the shell, independently of whether the agent's own filter approved or blocked it. A GuardFall bypass that defeats the agent's string-matching guard still cannot execute without PP authorization on deployments where PP instruments the shell tool-call path. PP cannot protect CI environments or developer machines where the agent executes shell commands through a path not instrumented with PP. Local machine attacks that bypass the agent's own filter and reach bash through an uninstrumented path remain outside PP's scope.

Incident analysis

Timeline and technical read

Timeline

2026-05-01
Adversa AI conducts GuardFall survey across 11 open-source AI coding agents, initially discovering the bypass in NousResearch/hermes-agent (commit 81cd67829), then systematically expanding to the broader agent category using five bypass classes against each agent.
2026-06-30
Adversa AI publishes full GuardFall research. Five bypass classes and four agent failure modes documented. Continue identified as the only agent with a correct defense — its five-component evaluator achieved 0 of 21 bypass cases reaching unsafe execution in testing.
2026-06-30
The Hacker News, SecurityWeek, SC Media, and SecurityAffairs report GuardFall. Combined vulnerable agent GitHub star count: approximately 548,000. No CVE identifiers assigned; Adversa AI frames the finding as a dangerous convention class, not a patchable bug.

Technical breakdown

The root cause is a model mismatch: agent command filters parse raw shell strings with regex or token matching, while bash's tokenizer performs quote stripping, variable expansion, and command substitution before execution. A string that looks safe to the filter can expand to a destructive command in bash — the filter and the shell are evaluating two different representations of the same string.
Class A (quote manipulation): bash strips adjacent empty quotes before execution, so r''m passes a guard checking for the literal string 'rm' but executes as rm. Class B (IFS expansion): rm$IFS-rf$IFS/ appears as a single token to a regex guard but expands to three separate shell arguments after parameter expansion — the form most common in production-environment bypasses.
Class C (command substitution): $(echo rm) -rf / computes the binary name dynamically at execution time; no static pattern guard can match a command name that does not appear in the raw string. Class D (Base64 piping): echo <payload> | base64 -d | sh decomposes the destructive payload across individually benign-looking tokens that the guard cannot reconstruct.
Class E (destructive utility flags) was rated the most successful and hardest to patch: find /x -delete, truncate -s 0, and dd of=/dev/sda achieve destruction through flag arguments on binaries that are not themselves on typical deny-lists. A complete enumeration of destructive flag combinations is not achievable with a static deny-list.
The four failure modes map to real agent architectures: regex over raw string (Hermes, opencode, Goose — all five bypass classes succeed); tokenized but raw-text matching (Cline, Roo-Code — Classes C and E bypass); no static guard plus auto-yes (Aider, Plandex, Open Interpreter — auto-execute eliminates the only backup safety check); sandboxed with local opt-out flags (OpenHands, SWE-agent — safe by default but ship documented flags that disable containment).

Severity rationale

High

High: structural vulnerability class affecting 10 of 11 surveyed open-source AI coding agents with a combined ~548,000 GitHub stars. Successful exploitation gives an attacker access to the operator's full account authority — SSH keys, cloud credentials, git config, browser tokens, CI deploy keys. Exploitation requires two preconditions: LLM cooperation with attacker framing and auto-execute mode enabled or a malicious repository flipping configuration. Not rated Critical because exploitation is probabilistic rather than deterministic; the underlying bypass technique is however trivially reproducible once both conditions are met.

Team takeaway

If you run Cline, Aider, OpenHands, Goose, Roo-Code, Plandex, Open Interpreter, SWE-agent, opencode, or Hermes with auto-execute on, a poisoned README or MCP response can wipe your SSH keys and cloud credentials — your agent's command filter will approve the shell command.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Tool execution / MCP. The relevant Permission Protocol gate is Tool-Call Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at: Tool-Call Gate — agent-issued shell command tool calls requiring authorization receipts before bash execution
Still needs: Agent-internal filter bypass detection; bash tokenization-layer command inspection; CI runner shell execution security; developer workstation local shell paths not instrumented with PP; auto-execute configuration auditing
Receipt required for: Any shell command with filesystem write, credential access, or network access scope; any command reading or writing files outside the project working directory; all CI shell commands issued by AI coding agents

PP's Tool-Call Gate adds an external authorization check on agent-issued tool calls, including shell command execution. Because PP's enforcement is external to the agent's runtime, a bypass of the agent's internal string-matching filter does not bypass PP — the shell command still needs a PP authorization receipt to execute through a PP-gated tool path.

Lessons for teams

String-matching command guards in AI coding agents are not security controls — they are false confidence mechanisms. A deny-list that operates on raw shell strings cannot protect against bash rewriting those strings through its tokenizer before execution.
Continue's reference design shows what a correct defense requires: sequential tokenization, variable expansion detection, substitution evaluation, pipe destination checking, and an explicit disabled list — all five components are necessary to close all five bypass classes. Partial implementations leave exploitable gaps.
Auto-execute flags and CI configurations that skip human confirmation eliminate the only backup safety check for agents using inadequate string-matching guards. Enabling auto-execute on any of the 10 vulnerable agents reduces GuardFall exploitation from possible to trivially reproducible via a single prompt injection.
Attacker-controlled content — repository README files, package configs, MCP server responses, web search results — is a viable injection vector for GuardFall payloads. AI coding agents that process these sources without sanitization are one poisoned repository away from operator-account compromise.
The GuardFall bypass classes are enumerated and published. All 10 vulnerable agents face reproducible exploitation using the documented techniques. Teams should treat all affected agents as unprotected against shell injection until they ship a tokenization-based defense equivalent to Continue's five-component evaluator.

Related incidents and controls

High2026-05-07

TrustFall Coding Agent Security Flaw Enables One-Click RCE

High2026-01-14

CVE-2026-22708: Cursor AI Allowlist Bypass via Shell Environment Poisoning Turned Trusted Commands Like 'git' into Arbitrary Code Execution

High2025-12-06

IDEsaster: 30+ Vulnerabilities Across All Major AI IDEs Chain Prompt Injection to RCE via IDE Settings Overwrite

Critical2026-05-12

Claude Code RCE — malicious deeplink injects SessionStart hook, executes arbitrary commands on victim machine with no additional interaction

Tool-Call Gate Why governance must be external

Start small

Put the relevant gate at this action boundary.

This incident maps to Tool-Call Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop