GuardFall Shell Injection Bypass Affects Most Open-Source AI Coding Agents

Researchers at Adversa AI disclosed GuardFall, a shell-interpretation bypass that affects 10 of 11 surveyed open-source AI coding and computer-use agents, allowing malicious commands to slip past safety filters. The flaw stems from agents checking raw command text while bash later rewrites and evaluates that text through expansion, substitution, and quote handling, enabling decades-old evasion techniques such as quoted token splitting, $IFS expansion, command substitution, and encoded pipelines. Adversa reported successful end-to-end exploitation against the production Plandex binary and said vulnerable agents include Hermes, opencode, Goose, Cline, Roo-Code, Aider, Plandex, Open Interpreter, OpenHands, and SWE-agent, while Continue was the only surveyed tool found to substantially mitigate the issue through structural command parsing and recursive analysis.

The attack becomes especially dangerous when an agent is induced by untrusted content—such as poisoned READMEs, Makefiles, MCP server responses, package metadata, or repository configuration files—to emit commands that are then auto-executed on the user’s host. Adversa warned that successful exploitation could expose SSH keys, cloud credentials, and files in $HOME, and noted that sandbox protections can disappear when agents are run in documented local-host modes. No public in-the-wild exploitation was reported, but researchers urged users to disable auto-execute features, isolate or redirect $HOME, avoid running agents on forked pull requests, audit repository-shipped configs, and adopt tokenize-and-canonicalize command enforcement instead of regex or raw-string blocklists.