GuardFall: Shell Injection Hits 10 of 11 AI Coding Agents

On June 30, Adversa AI researcher Omer Ben Simon published GuardFall — a class of shell injection bypasses that defeats the command guards in 10 of 11 popular open-source AI coding agents. The affected tools collectively hold roughly 548,000 GitHub stars. The fix is a two-day engineering task. Two weeks later, most teams haven’t shipped it.

The vulnerability is structural, not cosmetic. Most agents guard against dangerous commands by checking raw command text — regex patterns, string matching. But bash rewrites commands before it executes them. The guard and the shell end up looking at two different things. That gap is all an attacker needs.

Five Ways to Slip Past the Guard

Adversa’s research identified five bypass classes, each exploiting a different gap between text inspection and shell evaluation.

Quote removal. The string r''m looks like two tokens to a regex. Bash strips empty quotes and executes rm.

# Guard sees: r''m  |  Bash runs: rm
r''m -rf /tmp/repo

$IFS expansion. The internal field separator defaults to a space. rm$IFS-rf$IFS/ has no visible spaces — pattern matching sees one word. Bash expands it to three arguments.

rm$IFS-rf$IFS/

Command substitution. $(echo rm) evaluates to rm at runtime. The guard checks the substitution syntax; bash executes the result.

$(echo rm) -rf /

Base64 piping. Each pipe segment looks benign in isolation. Combined, they decode and execute whatever is in the payload.

echo cm0gLXJmIC8= | base64 -d | sh

Alternative utilities. Guards trained on rm don’t catch find /x -delete, dd if=/dev/zero of=/dev/sda, or truncate -s 0. All achieve the same result without triggering rm-specific filters.

None of these are new. Quote removal and $IFS tricks predate most of the developers who wrote these agents. The problem is applying 2026 AI capabilities on top of 1990s shell execution without the security model to match.

Who Is Affected

The ten vulnerable agents: Aider, Cline, opencode, Goose, Roo-Code, Plandex, Open Interpreter, OpenHands, SWE-agent, and Hermes. If you use any of these — especially in CI/CD with auto-execute enabled — you are exposed today.

Only Continue passed. It tokenizes commands using shell-quote parsing before any matching, detects $IFS expansion tokens and escalates to require permission, recurses into command substitutions, and checks pipe destinations rather than pipe sources. Researchers call this architecture a two-day implementation for an experienced engineer. It is also the only approach in the survey that actually works.

What Attackers Can Reach

These agents run commands with your full account permissions. A successful attack requires two conditions that are both routine in real deployments: attacker-controlled content the agent processes (a poisoned README, a malicious PR’s Makefile, a tampered MCP server description) and auto-execute mode enabled. The blast radius includes SSH private keys, AWS and GCP credentials, git credential helpers, Docker config, and every API token in a .env file. The attack surface is every repository the agent touches.

What to Do Before the Patches Ship

No single patch will close GuardFall because there is no single CVE. It is a design class, not a discrete bug. The Hacker News writeup and original research both note that adding more denylist patterns cannot fix a structural problem. Until affected projects ship structural fixes, take these steps.

Redirect $HOME to a throwaway sandbox:

HOME=$HOME/.agent-sandbox-$RANDOM aider --file repo/

This keeps SSH keys and cloud credentials out of reach even if a command bypasses the guard.

Disable auto-execute flags. Remove --yes from Aider invocations, --auto-approve from opencode, and equivalent flags from other tools. Do not run agents in CI on pull requests from untrusted forks.

Treat repo config files as untrusted code. Makefile, .aider.conf.yml, CONTRIBUTING.md — an attacker can plant instructions in any file the agent reads. The same threat model that applies to requirements.txt applies here.

The community has shipped destructive_command_guard, an open-source pre-execution hook with AST-based analysis that plugs into Claude Code, Copilot, and Gemini CLI. It is not a structural fix, but it raises the bar significantly while waiting for patches.

The Uncomfortable Takeaway

Using regex to guard shell execution is the 2026 equivalent of string-concatenating SQL. Parameterized queries solved that problem forty years ago. Shell-aware tokenization solves this one. The fact that 10 of 11 major tools built the same wrong architecture — and that most are still sitting on it two weeks after a public disclosure — suggests the AI tooling ecosystem has not internalized security-first design.

Check which agent you use. If it is on the affected list, apply the $HOME sandbox mitigation today. Then file an issue demanding the Continue-style evaluator. The structural fix exists. It just has not shipped. Follow Security Affairs for updates as patches land.