GuardFall: Shell-Injection Guardrail Bypass Exposes Open-Source AI Coding Agents to Supply-Chain Attacks
GuardFall: Shell-Injection Guardrail Bypass Exposes (TL-2026-1131), also tracked as GuardFall Shell-Guard Bypass, is a high-severity software vulnerability, first published 2026-06-30. It has no confirmed attribution, affects NousResearch hermes-agent, maps to 19 MITRE ATT&CK techniques (T1005, T1027, T1041), and is covered by 9 detection rules and 24 indicators of compromise.
Key facts for TL-2026-1131
- Threat ID
- TL-2026-1131
- Also known as
- GuardFall Shell-Guard Bypass, AI Coding Agent Shell Injection Bypass
- Severity
- HIGH
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-06-30
- Last reviewed
- 2026-06-30
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, devops, government administration, finance, health
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 24
Malware and tooling in GuardFall: Shell-Injection Guardrail Bypass Exposes
Malware and tooling: Aider-AI/aider, All-Hands-AI/OpenHands, NousResearch/hermes-agent, OpenInterpreter/open-interpreter, RooCodeInc/Roo-Code, SWE-agent/SWE-agent, TrustFall, block/goose, cline/cline, continuedev/continue, plandex-ai/plandex, sst/opencode
Adversa AI researchers disclosed 'GuardFall', a shell-interpretation bypass technique that defeats command-execution safety filters in 10 of 11 tested open-source AI coding/computer-use agents. The agents validate raw command text against a blocklist while bash independently rewrites that text (quote removal, $IFS expansion, command substitution, encoded pipelines, alternative destructive argv shapes), letting a booby-trapped repository or package smuggle destructive commands or credential-theft payloads past the filter and execute them with the victim's full account privileges.
How GuardFall: Shell-Injection Guardrail Bypass Exposes works
GuardFall is a class of shell-guard bypasses disclosed by Adversa AI (CTO Alex Polyakov) on 2026-06-30, following a live-confirmed bypass the researchers first found against NousResearch's Hermes agent. Adversa surveyed 11 of the most popular open-source AI coding and computer-use agents, ranked by GitHub star count and community activity as of May 2026: NousResearch/hermes-agent, sst/opencode, block/goose, cline/cline, RooCodeInc/Roo-Code, continuedev/continue, Aider-AI/aider, plandex-ai/plandex, OpenInterpreter/open-interpreter, All-Hands-AI/OpenHands, and SWE-agent/SWE-agent.
The root cause is architectural, not a single coding bug: these agents implement 'command guards' that inspect the raw command string the LLM proposes against a blocklist/denylist (often a small set of regex patterns, e.g. Hermes's 30-pattern 'approval gate'), but the actual execution happens via bash, which independently expands, unquotes, substitutes, and rewrites that same text before running it. Because the guard and the shell parse two different representations of the 'same' command, an attacker who controls content the agent reads (a README, Makefile, package script, issue, or repository config) can smuggle a shell-injected instruction that looks benign to the string-matching filter but is rewritten by bash into a destructive or data-exfiltrating command.
Adversa documented five bypass classes: (A) quote removal / quoted-token splitting, where bash's automatic quote stripping produces a token stream the filter's literal-string match never sees; (B) $IFS field-separator expansion (e.g. rm$IFS-rf$IFS/), where a filter keyed on a literal space in 'rm -rf' never matches the $IFS-joined form even though bash expands it identically; (C) command substitution (e.g. $(echo rm) -rf /), where the filter sees a substitution expression rather than the literal binary name; (D) base64-encoded pipelines to a shell interpreter (e.g. echo <base64> | base64 -d | sh), where each pipeline segment is benign in isolation but the composed pipeline decodes and executes an arbitrary payload; and (E) alternative destructive argv shapes that achieve the same effect as 'rm' without ever calling it — find /x -delete, dd of=/dev/sda, tar -C / -x, install -m 4755 payload /usr/local/bin/backdoor, and destructive in-place sed edits.
Results varied by guard architecture. The three regex-over-raw-string agents leaked almost every probe: Hermes fell to all 5 bypass classes, opencode leaked 16 of 16 probes, and Goose leaked 22 of 23. The two tokenized agents fared better but were not sound: Cline's opt-in tokenized guard leaked 2 of 13 probes (and ships with no guard enabled by default), and Roo-Code's tokenized guard leaked 4 of 18. Five agents — Aider, Plandex, Open Interpreter, Cline (default), and OpenHands — shipped with no command guard at all, relying entirely on auto-approve/auto-execute trust. SWE-agent was also found vulnerable. Continue was the sole exception: its default evaluator tokenizes and canonicalizes the command the way bash will before enforcing a hard-coded disabled list of destructive shapes, and this held against every payload tested in Continue's default editor mode — Class E (alternative argv shapes) is noted as the hardest class to fully close even for a sound tokenized guard, because it requires per-flag, per-binary reasoning about which argument combinations flip a utility from benign to destructive.
No CVE was assigned; researchers frame GuardFall as 'not a bug, but a dangerous convention' — a structural class of problems spanning independent codebases rather than a single patchable flaw. Adversa explicitly rejected a per-vendor responsible-disclosure process for GuardFall, reasoning that 'you can responsibly disclose a vulnerability to a vendor, but not a convention': because the same bypass classes recur independently across unrelated codebases rather than residing in one patchable component, the researchers chose public disclosure over private vendor notification. To ground the risk beyond synthetic probes, Adversa additionally demonstrated end-to-end exploitation against the production Plandex binary using GuardFall bypass techniques, confirming the technique defeats a live, deployed agent build rather than only a lab-simulated harness. No confirmed in-the-wild exploitation has been reported; Adversa characterizes the work as lab research. The realistic attack scenario is supply-chain: a malicious or compromised open-source repository, forked pull request, or package that a developer points an AI coding agent at can carry a hidden GuardFall-class instruction; because these agents execute shell commands with the operator's full account authority, successful exploitation can result in destructive file/disk operations or theft of SSH keys, cloud credentials, and other secrets reachable from the developer's home directory — creating a path for a single malicious pull request to compromise the tooling and secrets of a widely-used software project before any human reviews the change.
GuardFall follows an earlier related disclosure from the same Adversa AI research lineage: 'TrustFall' (disclosed 2026-05-07), where a malicious repository-shipped MCP (Model Context Protocol) server configuration auto-starts and executes after a developer accepts a folder-trust prompt in Claude Code, Gemini CLI, Cursor CLI, and GitHub Copilot CLI — a related but distinct trust-boundary failure in agentic coding tools, illustrating a broader pattern of execution-guard and trust-boundary weaknesses across the AI coding agent ecosystem that GuardFall extends into the shell-guard layer specifically.
MITRE ATT&CK techniques used in TL-2026-1131
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Execution
T1059 Command and Scripting Interpreter
Command and Control
T1071 Application Layer Protocol
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery
Initial Access
Impact
T1485 Data Destruction; T1561 Disk Wipe; T1565 Data Manipulation
Credential Access
T1528 Steal Application Access Token; T1552 Unsecured Credentials
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
Persistence
T1554 Compromise Host Software Binary
Resource Development
Affected products and versions in GuardFall: Shell-Injection Guardrail Bypass Exposes
- NousResearch — hermes-agent
Vulnerable versions: default 30-pattern regex denylist 'approval gate' configuration, as tested May 2026 - sst — opencode
Vulnerable versions: default regex-over-raw-string command guard, as tested May 2026 - block — goose
Vulnerable versions: default regex-over-raw-string command guard, as tested May 2026 - cline — cline
Vulnerable versions: default configuration ships with no command guard enabled; opt-in tokenized guard leaks 2 of 13 probes - RooCodeInc — Roo-Code
Vulnerable versions: default tokenized guard, leaks 4 of 18 probes - Aider-AI — aider
Vulnerable versions: no command guard/filter present - plandex-ai — plandex
Vulnerable versions: no command guard/filter present - OpenInterpreter — open-interpreter
Vulnerable versions: no command guard/filter present - All-Hands-AI — OpenHands
Vulnerable versions: no command guard/filter present - SWE-agent — SWE-agent
Vulnerable versions: vulnerable to GuardFall bypass classes, as tested May 2026
Remediation for GuardFall: Shell-Injection Guardrail Bypass Exposes
Patches
- No vendor patch resolves GuardFall broadly; it is an architectural weakness spanning multiple independent open-source projects rather than a single patchable CVE
- Continue's default tokenize-and-canonicalize evaluator with an explicit disabled-list of destructive command shapes is the only tested implementation that substantially mitigated the bypass classes
Immediate actions
- Disable auto-execute/auto-approve modes in AI coding agents and require explicit human-in-the-loop approval for every shell command the agent proposes
- Do not run agentic coding tools against untrusted repositories, forked pull requests, or unreviewed packages without isolation
- Audit and strip any command-execution configuration shipped inside cloned repositories (agent config files, Makefiles, pre-commit hooks, install scripts) before invoking an agent against that repo
- Treat any AI coding agent lacking a documented, sound command guard as running with unrestricted shell access and scope its use accordingly
- Redirect $HOME to a throwaway/scoped directory before invoking an agent so secrets under ~/.ssh and ~/.aws remain out of reach even if a shell-guard bypass succeeds
Workarounds
- Manually review every agent-proposed shell command for $IFS, command substitution $(...), base64/piped decoding, or non-'rm' destructive utilities (dd, tar, find, install, sed) before approving
- Restrict agent execution to read-only or explicitly non-destructive shell profiles where the workflow allows it
Longer-term hardening
- Replace raw-string/regex command blocklists with a tokenize-and-canonicalize evaluator that parses the proposed command the same way the shell will before enforcement, per Continue's demonstrated approach
- Run agents inside sandboxed/ephemeral environments (containers, VMs, restricted namespaces) under least-privilege service accounts rather than the developer's full user credentials
- Isolate or redirect $HOME and constrain the filesystem/network scope reachable by the agent process
- Maintain an explicit denylist of destructive argv shapes independent of binary-name matching (dd, find -delete, tar extraction to /, install with setuid bits, in-place sed on system paths)
- Adopt a zero-trust posture toward autonomous coding agents, treating them as potential insider-threat actors requiring scoped identities and runtime monitoring
Weaknesses (CWE) in GuardFall: Shell-Injection Guardrail Bypass Exposes
CWE-78, CWE-88
Timeline of GuardFall: Shell-Injection Guardrail Bypass Exposes
- As part of the same research effort, Adversa AI demonstrates end-to-end exploitation against the production Plandex binary using GuardFall bypass techniques, confirming the technique defeats a live, deployed agent build rather than only a synthetic lab harness.
- Adversa AI confirms an initial shell-guard bypass live against NousResearch's Hermes agent (defeating its 30-pattern regex denylist 'approval gate'), then expands the work into a survey of the 11 most popular open-source AI coding/computer-use agents ranked by GitHub star count and community activity as of May 2026.
- Adversa AI publicly discloses 'TrustFall', a related coding-agent trust-boundary flaw in which a malicious repository-shipped MCP server configuration auto-starts after a folder-trust prompt is accepted, affecting Claude Code, Gemini CLI, Cursor CLI, and GitHub Copilot CLI — the same research lineage that produced GuardFall.
- The Hacker News, Security Affairs, SC Media, Cybernews, SecurityWeek, and Mallory.ai publish coverage summarizing the GuardFall disclosure the same day as the Adversa AI research post.
- Adversa AI states it deliberately bypassed a per-vendor responsible-disclosure process for GuardFall, reasoning that 'you can responsibly disclose a vulnerability to a vendor, but not a convention' since the bypass classes recur independently across unrelated codebases rather than residing in one patchable component.
- Adversa AI publishes the GuardFall research: 10 of 11 tested open-source AI coding/computer-use agents (Hermes, opencode, Goose, Cline, Roo-Code, Aider, Plandex, Open Interpreter, OpenHands, SWE-agent) are shown bypassable via decades-old bash quoting/expansion tricks; Continue is the sole agent whose default evaluator substantially mitigates the bypass classes.
- Adversa AI's 'Top Agentic AI Security Resources — July 2026' roundup frames GuardFall as prompt injection reaching bash with the operator's full authority, positioning it alongside other July disclosures such as the AutoJack exploit chain against AutoGen Studio and the IMA multi-agent jailbreak study.
- GuardFall is included in defend.network's daily cybersecurity briefing alongside other actively exploited AI-agent-adjacent vulnerabilities (Langflow RCE cryptojacking, SimpleHelp CVE-2026-48558, BlueHammer).
- The GuardFall/'Decades-Old Bash Tricks' story reaches broader developer and security community discussion via Slashdot.
Sources cited for GuardFall: Shell-Injection Guardrail Bypass Exposes
- GuardFall Exposes Open-Source AI Coding Agents to Decades-Old Shell Injection Risks
- AI coding agents vulnerability: GuardFall shell injection
- GuardFall Flaw Hits 10 of 11 Popular Open-Source AI Agents
- GuardFall Shell Injection Bypass Affects Most Open-Source AI Coding Agents
- Shell injection flaw found in 10 of 11 open-source AI agents
- Decades-Old Bash Tricks Expose AI Coding Agents to Supply Chain Attacks
- Simple shell tricks bypass AI agent security
- Decades-Old Bash Tricks Expose AI Coding Agents To Supply Chain Attacks (Slashdot discussion)
- AI agent poisoning, Langflow RCE exploited (daily briefing)
- Top Agentic AI security resources — July 2026
- TrustFall: coding agent security flaw enables one-click RCE in Claude, Cursor, Gemini CLI and GitHub Copilot
- One keypress is all it takes to compromise four AI coding tools
- TrustFall turns AI coding-agent folder trust into code execution
Threats related to GuardFall: Shell-Injection Guardrail Bypass Exposes
- Dell PowerProtect Data Domain Multiple Vulnerabilities: Improper Authentication (CVE-2026-53483) and Path Traversal (CVE-2026-53481) Allow Full Remote System Access
- Multiple JetBrains Product Vulnerabilities: Account Takeover, Privilege Escalation, and RCE Across Hub, YouTrack, IntelliJ IDEA, Kotlin, GoLand, and TeamCity
- Gogs Authenticated RCE via Argument Injection in git rebase --exec (Unpatched, CVSSv4 9.4, GHSA-qf6p-p7ww-cwr9)
- Multiple WolfSSL Critical Vulnerabilities: Certificate Bypass, RCE, and Post-Quantum Weakening
Detection coverage for TL-2026-1131
As of 2026-06-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1131 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.