On June 30, Adversa AI published GuardFall: a shell injection bypass that defeats the command filters in 10 of 11 popular open-source AI coding agents. The affected tools include Aider, Cline, Roo-Code, Goose, Plandex, Open Interpreter, OpenHands, SWE-agent, opencode, and Hermes. One agent — Continue — substantially defends against it. The rest will silently execute arbitrary shell commands if a developer runs them against a malicious repository.
These agents run with your full account permissions. That means SSH keys, AWS credentials, shell history — anything in ~/.ssh/ or ~/.aws/. The attack vector is a poisoned README, Makefile, or configuration file — content your agent reads as context before deciding what to run.
GuardFall: The Gap Between What the Filter Sees and What Bash Runs
The root cause is a mismatch that has been sitting in security literature for decades. AI coding agents apply text-based filters to check commands before executing them: blocklists, allowlists, pattern matches against known dangerous strings. However, bash doesn’t run the command as-written. Bash rewrites it first — expanding variables, stripping quotes, evaluating subshells — and then runs the result. The filter and the shell inspect two different things.
Adversa AI documented five bypass classes that exploit this gap:
- Quote removal:
r''m— the filter sees norm, bash strips the empty string literal and runsrm - $IFS expansion:
rm$IFS-rf$IFS/— looks like one word to a pattern filter, three arguments to bash (IFS is the field separator) - Command substitution:
$(echo rm) -rf /— normliteral; bash evaluates the subshell first - Base64 encoding:
echo "cm0gLXJmIC8=" | base64 -d | bash— each segment is benign, the combination decodes and runs the payload
The $IFS bypass is the clearest illustration:
# What the filter sees (no "rm" literal — passes blocklist check):
rm$IFS-rf$IFS~/.ssh/
# What bash actually executes ($IFS = space by default):
rm -rf ~/.ssh/
The practical consequence: a malicious README can embed any of these patterns, an agent reads it as context, and bash runs the destructive command while the filter reports nothing dangerous was found.
Ten Agents Vulnerable, One Not — What Continue Does Differently
The scope is notable. Aider, Cline, and Roo-Code collectively have millions of active users. Goose is Block’s agent. Open Interpreter and OpenHands are among the most downloaded agents for automated coding tasks. According to The Hacker News, the Cloud Security Alliance estimated over 500,000 open-source deployments affected. Most of them run in developers’ primary environments — not sandboxes — often with auto-yes flags enabled.
Continue escapes this list because it takes a different approach. Instead of matching against raw command text, Continue tokenizes commands using shell-quote parsing before applying any checks. It detects variable expansion tokens like $IFS and escalates those commands to require explicit user confirmation. Command substitutions get evaluated recursively — Continue’s verdict on the outer command is constrained by what’s inside the subshell. This is lexical analysis, not string matching. The distinction is everything.
Related: ANSI Escape Injection in MCP Servers: What AI Agents See That You Don’t
A Blocklist Patch Won’t Fix This
The affected vendors will release patches. Some already have. These patches add more strings to the blocklist. That is not a fix — it’s a round of whack-a-mole against an infinite attack surface. Security Affairs noted that every bypass technique uses a bash feature documented in security research for 30+ years. Closing one pattern leaves four others open.
Continue demonstrates the correct architecture. The fix isn’t a longer blocklist — it’s moving the inspection layer to the right place: after bash parsing, not before it. An agent that tokenizes and canonicalizes commands before checking them sees what bash sees. An agent that pattern-matches raw text is inspecting something the shell has already discarded. When your vendor says “we updated our blocklist in response to GuardFall,” that is an incomplete answer.
What Developers Should Do Right Now
Three mitigations are available today, regardless of which agent you use. SecurityWeek covered all three in their analysis of the GuardFall disclosure.
Disable auto-execute flags. Most affected agents ship with flags like --auto-exec, --auto-run, dangerously-skip-permissions, or auto-mode: full. Turn these off. Manual confirmation on every shell command is your last checkpoint before bash processes the payload. The confirmation prompt can’t canonicalize an obfuscated command, but it gives you the chance to inspect it.
Redirect $HOME. This one-liner wraps your agent invocation and removes the primary attack target — credentials stored in your home directory:
HOME=$HOME/.agent-sandbox-$RANDOM your-agent-command-hereThe agent still accesses your project directory. It loses access to ~/.ssh/, ~/.aws/, and shell history. The payload can still execute, but silent credential exfiltration becomes significantly harder.
Treat external content as hostile. Any repository you didn’t write, any PR you haven’t fully reviewed, any package from a public registry — its README, Makefile, and config files are potential injection surfaces when processed by an AI coding agent. The attack looks indistinguishable from a legitimate project until bash runs it.
Key Takeaways
- GuardFall, published June 30 by Adversa AI, affects 10 of 11 open-source AI coding agents — Aider, Cline, Roo-Code, Goose, Plandex, Open Interpreter, OpenHands, SWE-agent, opencode, and Hermes — with 500,000+ estimated deployments exposed
- The root cause is architectural: command filters inspect raw text, but bash rewrites that text before executing it — the bypass techniques are decades old and the list of them is not finite
- Continue is the only surveyed agent with a structural defense: tokenize-and-canonicalize before matching, recursive evaluation of subshells, explicit disabled list for destructive canonical patterns
- Disable auto-execute flags and redirect
$HOMEtoday — two changes requiring minutes that significantly reduce credential exposure while waiting for structural fixes from affected vendors
