GuardFall: Shell-Injection Guardrail Bypass Exposes Open-Source AI Coding Agents to Supply-Chain Attacks — Threadlinqs Intelligence
As of 2026-07-05, GuardFall: Shell-Injection Guardrail Bypass Exposes Open-Source AI Coding Agents to Supply-Chain Attacks is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 24 indicators of compromise.
Threat ID: TL-2026-1131 · Severity: HIGH · Status: ACTIVE · Category: VULNERABILITY
Adversa AI researchers disclosed 'GuardFall', a shell-interpretation bypass technique that defeats command-execution safety filters in 10 of 11 tested open-source AI coding/computer-use agents. The
GuardFall is a class of shell-guard bypasses disclosed by Adversa AI (CTO Alex Polyakov) on 2026-06-30, following a live-confirmed bypass the researchers first found against NousResearch's Hermes agent. Adversa surveyed 11 of the most popular open-source AI coding and computer-use agents, ranked by GitHub star count and community activity as of May 2026: NousResearch/hermes-agent, sst/opencode, block/goose, cline/cline, RooCodeInc/Roo-Code, continuedev/continue, Aider-AI/aider, plandex-ai/plandex, OpenInterpreter/open-interpreter, All-Hands-AI/OpenHands, and SWE-agent/SWE-agent.
The root cause is architectural, not a single coding bug: these agents implement 'command guards' that inspect the raw command string the LLM proposes against a blocklist/denylist (often a small set of regex patterns, e.g. Hermes's 30-pattern 'approval gate'), but the actual execution happens via bash, which independently expands, unquotes, substitutes, and rewrites that same text before running it. Because the guard and the shell parse two different representations of the 'same' command, an attacker who controls content the agent reads (a README, Makefile, package script, issue, or repository config) can smuggle a shell-injected instruction that looks benign to the string-matching filter but is rewritten by bash into a destructive or data-exfiltrating command.
Adversa documented five bypass classes: (A) quote removal / quoted-token splitting, where bash's automatic quote stripping produces a token stream the filter's literal-string match never sees; (B) $IFS field-separator expansion (e.g. rm$IFS-rf$IFS/), where a filter keyed on a literal space in 'rm -rf' never matches the $IFS-joined form even though bash expands it identically; (C) command substitution (e.g. $(echo rm) -rf /), where the filter sees a substitution expression rather than the literal binary name; (D) base64-encoded pipelines to a shell interpreter (e.g. echo <base64> | base64 -d | sh), where each pipeline segment is benign in isolation but the composed pipeline decodes and executes an arbitrary payload; and (E) alternative destructive argv shapes that achieve the same effect as 'rm' without ever calling it — find /x -delete, dd of=/dev/sda, tar -C / -x, install -m 4755 payload /usr/local/bin/backdoor, and destructive in-place sed edits.
Results varied by guard architecture. The three regex-over-raw-string agents leaked almost every probe: Hermes fell to all 5 bypass classes, opencode leaked 16 of 16 probes, and Goose leaked 22 of 23. The two tokenized agents fared better but were not sound: Cline's opt-in tokenized guard leaked 2 of 13 probes (and ships with no guard enabled by default), and Roo-Code's tokenized guard leaked 4 of 18. Five agents — Aider, Plandex, Open Interpreter, Cline (default), and OpenHands — shipped with no command guard at all, relying entirely on auto-approve/auto-execute trust. SWE-agent was also found vulnerable. Continue was the sole exception: its default evaluator tokenizes and canonicalizes the command the way bash will before enforcing a hard-coded disabled list of destructive shapes, and this held against every payload tested in Continue's default editor mode — Class E (alternative argv shapes) is noted as the hardest class to fully close even for a sound tokenized guard, because it requires per-flag, per-binary reasoning about which argument combinations flip a utility from benign to destructive.
No CVE was assigned; researchers frame GuardFall as 'not a bug, but a dangerous convention' — a structural class of problems spanning independent codebases rather than a single patchable flaw. Adversa explicitly rejected a per-vendor responsible-disclosure process for GuardFall, reasoning that 'you can responsibly disclose a vulnerability to a vendor, but not a convention': because the same bypass classes recur independently across unrelated codebases rather than residing in one patchable component, the researchers chose public disclosure over private ven
Weaknesses (CWE)
CWE-78, CWE-88
Target sectors: technology, software-development, devops, government administration, finance, health
Target regions: Global
Detections & IOCs
As of 2026-07-20, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 24 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, T1587, T1608, T1195, T1195, T1059, T1059, T1554, T1548, T1027, T1027