In a nutshell: GuardFall enables attackers to inject malicious commands into AI agents through Bash tricks that circumvent text-based security filters by expanding the harmful commands only after internal inspection by the shell.
Adversa AI has identified a security vulnerability named GuardFall in ten of eleven tested open-source AI coding agents that allows attackers to bypass text-based protection filters using classic Unix shell techniques. The vulnerability endangers supply-chain processes since AI agents run with full developer permissions.
Security company Adversa AI has documented a structural vulnerability in numerous open-source AI coding agents. GuardFall is based on decades-old Bash mechanisms such as quote removal or the use of environment variables for spacing. Attackers leverage these techniques to cause malicious commands to expand and execute only after internal security inspection by the shell – thereby circumventing the text-based protection filters of the AI tools.
Of eleven tested applications, ten exhibited corresponding security vulnerabilities. Affected tools include Hermes, OpenCode and Roo-code. Only Continue was able to block the majority of attacks through a specialized filter that tokenizes and canonicalizes commands before execution. The attacks were divided into five classes. Particularly effective proved to be a method in which alternative argument structures are used to disguise malicious commands as benign – filters would then need to know the exact flag combinations of individual binaries.
The vulnerability enables attackers to inject malicious commands into AI systems via manipulated repositories. When a developer instructs a vulnerable agent to read a manipulated README file or a prepared Makefile from a malicious repository, the system can be induced to covertly execute code – such as stealing AWS credentials or deleting entire development environments, especially in CI pipelines with automatic confirmation modes. Since AI agents typically run with full account permissions of the respective developer, far-reaching supply-chain risks emerge.
As a short-term countermeasure, the researchers propose running AI agents in an isolated shell with redirected home directories. A single-line wrapper can maintain the project directory while still denying access to sensitive data such as SSH keys, AWS credentials or shell history. Additionally, automatic confirmation modes should be disabled and configurations from external repositories should be strictly reviewed. In the long term, developers of AI tools must implement internal validation filters that normalize incoming text before passing it to the system shell, to close the discrepancy between agent inspection and actual Bash execution.
Source: www.it-daily.net · Published 12 July 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.