GuardFall: Shell Injection Bypass Leaves 10 of 11 AI Coding Agents Open to File Deletion and Credential Theft

Security researchers at Adversa AI have identified a class of vulnerability they have named GuardFall that allows attackers to bypass the safety filters built into AI coding agents using shell injection techniques that have been publicly documented for decades. Of eleven popular open-source AI coding and computer-use agents tested, ten were found to be vulnerable. Only one, the Continue agent, was built in a way that defends against the technique.

The agents confirmed vulnerable are opencode, Goose, Cline, Roo-Code, Aider, Plandex, Open Interpreter, OpenHands, SWE-agent, and the Hermes project, where the underlying issue was first identified and is now tracked in the project's own issue tracker. The live tests used Claude Sonnet 4.6. The tools in the study collectively carried approximately 548,000 GitHub stars as of May 2026. Adversa demonstrated the full attack end-to-end against the production Plandex binary and confirmed the same pattern held against eight others.

Why the bypass works

AI coding agents protect against dangerous shell commands by checking each command against a blocklist of known dangerous patterns before execution. The fundamental flaw is that this check is applied to the command as plain text, while the shell rewrites that text before it actually runs. The filter and the shell are reading two different things.

The simplest illustration: a filter watching for rm sees nothing harmful in r''m, because to a text matcher those are different strings. Bash removes the empty quotes at runtime and executes rm anyway. The same principle applies in more sophisticated forms, including commands hidden in base64 and piped into a shell interpreter, and ordinary utilities like find and dd turned destructive by their flags.

Adversa describes this not as a single bug but as a class of dangerous conventions, which is precisely why adding more blocklist patterns does not fix it. There is no CVE to patch in the traditional sense. The weakness is architectural.

Two conditions that are not exotic

For the attack to succeed, two things must be in place. First, the AI agent has to produce the malicious command. A direct request to run rm -rf is usually refused, but the same command embedded within a build file, a dependency, or a tool's documentation reply is emitted as a routine step in automated work. Second, the agent must be running with an auto-execute flag enabled or its container sandbox disabled, both of which are standard configurations in automated CI/CD pipelines.

What an attacker with a compromised repository or a poisoned software package can do once these conditions are met includes deleting files, exfiltrating SSH keys and cloud credentials from the home directory, and accessing any other resource the agent's account can reach.

The one agent that holds

Continue, the single agent that resisted every payload in its default editor mode, defends correctly by reading the command the way bash will before making any safety decision. It tokenises the command into the same pieces the shell would produce, checks what will actually execute, and maintains a hard block list of destructive commands that is enforced regardless of obfuscation. Adversa describes this design as portable and estimates that re-implementing it in a vulnerable agent is approximately two days of work for an experienced engineer.

What to do now

None of the immediate workarounds is a complete fix, but they reduce exposure materially while proper guards are built. Set the $HOME environment variable to a throwaway directory for agent processes so that SSH keys, cloud credentials, and other secrets under the real home directory are out of reach. Disable auto-execute flags such as --auto-exec, --auto-run, --auto-test, and dangerously-skip-permissions unless the specific task genuinely cannot pause for a human review step. Do not allow agents to run against pull requests from external forks. Treat any configuration file shipped inside a repository as untrusted code, since a malicious .aider.conf.yml or equivalent can trigger the attack on the first accepted edit.

GuardFall follows a series of related findings this year including TrustFall, which affected Claude Code, Cursor, Gemini CLI, and Copilot CLI, and AutoJack and Agentjacking, which turned poisoned content into commands executed with owner privileges. The common thread across every case is that untrusted text is reaching a real shell before any guard understands what the shell will actually run.