At a glance: GuardFall exploits decades-old Bash techniques such as quoting tricks and environment variables to bypass security filters and execute arbitrary commands in AI agents.
Researchers from Adversa AI have identified a structural vulnerability named GuardFall that enables attackers to bypass the protection filters of AI coding agents via classic Unix shell mechanisms. Ten out of eleven tested open-source tools were vulnerable to the attack.
The vulnerability is based on a timing discrepancy between the text inspection performed by the AI agent and the actual shell execution. The AI protection filter inspects the input text for suspicious commands before passing it to the system shell. However, Bash only expands certain constructs such as quoting, escape sequences or environment variables after this inspection. This makes it possible to hide malicious commands that only become visible at runtime.
In testing, eleven popular open-source AI coding agents were examined, including Hermes, OpenCode and Roo-code. Ten of them were vulnerable to GuardFall; only Continue was able to block most attacks through a special filter that tokenizes and canonicalizes commands before execution. Attackers used five different attack methods, with the use of alternative argument structures proving particularly effective for disguising malicious commands. To block such attacks, filters would need to know the exact flag combinations for every single binary.
For CISOs, the supply chain risk is relevant: an attacker can inject malicious commands into a repository — for example in a manipulated README or Makefile. If a developer uses a vulnerable agent to read such files, the agent can be tricked into executing arbitrary commands in the background: stealing AWS credentials, deleting development environments or compromising entire CI pipelines. Since AI agents typically run with the full account privileges of the developer, this creates a significant escalation risk.
In the short term, AI agents should be run in an isolated shell with a redirected home directory — a simple wrapper can provide access to the project directory but block access to SSH keys, AWS credentials and shell history. Additionally, automatic confirmation modes should be disabled and external configurations should be strictly validated. In the long term, AI tool developers must implement internal filters that normalize incoming text before passing it to the shell.
Source: www.it-daily.net · Published 12 July 2026
Lumi AI News — AI-assisted curation in accordance with Article 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.