# GuardFall: Shell-Injection Guardrail Bypass Exposes Open-Source AI Coding Agents to Supply-Chain Attacks

> Adversa AI researchers disclosed 'GuardFall', a shell-interpretation bypass technique that defeats command-execution safety filters in 10 of 11 tested open-source AI coding/computer-use agents. The agents validate raw command text against a blocklist while bash independently rewrites that text (quote removal, $IFS expansion, command substitution, encoded pipelines, alternative destructive argv shapes), letting a booby-trapped repository or package smuggle destructive commands or credential-theft payloads past the filter and execute them with the victim's full account privileges.

- **Published:** 2026-06-30T00:00:00Z
- **Last reviewed:** 2026-06-30T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1131
- **ID:** TL-2026-1131
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

GuardFall is a class of shell-guard bypasses disclosed by Adversa AI (CTO Alex Polyakov) on 2026-06-30, following a live-confirmed bypass the researchers first found against NousResearch's Hermes agent. Adversa surveyed 11 of the most popular open-source AI coding and computer-use agents, ranked by GitHub star count and community activity as of May 2026: NousResearch/hermes-agent, sst/opencode, block/goose, cline/cline, RooCodeInc/Roo-Code, continuedev/continue, Aider-AI/aider, plandex-ai/plandex, OpenInterpreter/open-interpreter, All-Hands-AI/OpenHands, and SWE-agent/SWE-agent.

The root cause is architectural, not a single coding bug: these agents implement 'command guards' that inspect the raw command string the LLM proposes against a blocklist/denylist (often a small set of regex patterns, e.g. Hermes's 30-pattern 'approval gate'), but the actual execution happens via bash, which independently expands, unquotes, substitutes, and rewrites that same text before running it. Because the guard and the shell parse two different representations of the 'same' command, an attacker who controls content the agent reads (a README, Makefile, package script, issue, or repository config) can smuggle a shell-injected instruction that looks benign to the string-matching filter but is rewritten by bash into a destructive or data-exfiltrating command.

Adversa documented five bypass classes: (A) quote removal / quoted-token splitting, where bash's automatic quote stripping produces a token stream the filter's literal-string match never sees; (B) $IFS field-separator expansion (e.g. rm$IFS-rf$IFS/), where a filter keyed on a literal space in 'rm -rf' never matches the $IFS-joined form even though bash expands it identically; (C) command substitution (e.g. $(echo rm) -rf /), where the filter sees a substitution expression rather than the literal binary name; (D) base64-encoded pipelines to a shell interpreter (e.g. echo <base64> | base64 -d | sh), where each pipeline segment is benign in isolation but the composed pipeline decodes and executes an arbitrary payload; and (E) alternative destructive argv shapes that achieve the same effect as 'rm' without ever calling it — find /x -delete, dd of=/dev/sda, tar -C / -x, install -m 4755 payload /usr/local/bin/backdoor, and destructive in-place sed edits.

Results varied by guard architecture. The three regex-over-raw-string agents leaked almost every probe: Hermes fell to all 5 bypass classes, opencode leaked 16 of 16 probes, and Goose leaked 22 of 23. The two tokenized agents fared better but were not sound: Cline's opt-in tokenized guard leaked 2 of 13 probes (and ships with no guard enabled by default), and Roo-Code's tokenized guard leaked 4 of 18. Five agents — Aider, Plandex, Open Interpreter, Cline (default), and OpenHands — shipped with no command guard at all, relying entirely on auto-approve/auto-execute trust. SWE-agent was also found vulnerable. Continue was the sole exception: its default evaluator tokenizes and canonicalizes the command the way bash will before enforcing a hard-coded disabled list of destructive shapes, and this held against every payload tested in Continue's default editor mode — Class E (alternative argv shapes) is noted as the hardest class to fully close even for a sound tokenized guard, because it requires per-flag, per-binary reasoning about which argument combinations flip a utility from benign to destructive.

No CVE was assigned; researchers frame GuardFall as 'not a bug, but a dangerous convention' — a structural class of problems spanning independent codebases rather than a single patchable flaw. Adversa explicitly rejected a per-vendor responsible-disclosure process for GuardFall, reasoning that 'you can responsibly disclose a vulnerability to a vendor, but not a convention': because the same bypass classes recur independently across unrelated codebases rather than residing in one patchable component, the researchers chose public disclosure over private vendor notification. To ground the risk beyond synthetic probes, Adversa additionally demonstrated end-to-end exploitation against the production Plandex binary using GuardFall bypass techniques, confirming the technique defeats a live, deployed agent build rather than only a lab-simulated harness. No confirmed in-the-wild exploitation has been reported; Adversa characterizes the work as lab research. The realistic attack scenario is supply-chain: a malicious or compromised open-source repository, forked pull request, or package that a developer points an AI coding agent at can carry a hidden GuardFall-class instruction; because these agents execute shell commands with the operator's full account authority, successful exploitation can result in destructive file/disk operations or theft of SSH keys, cloud credentials, and other secrets reachable from the developer's home directory — creating a path for a single malicious pull request to compromise the tooling and secrets of a widely-used software project before any human reviews the change.

GuardFall follows an earlier related disclosure from the same Adversa AI research lineage: 'TrustFall' (disclosed 2026-05-07), where a malicious repository-shipped MCP (Model Context Protocol) server configuration auto-starts and executes after a developer accepts a folder-trust prompt in Claude Code, Gemini CLI, Cursor CLI, and GitHub Copilot CLI — a related but distinct trust-boundary failure in agentic coding tools, illustrating a broader pattern of execution-guard and trust-boundary weaknesses across the AI coding agent ecosystem that GuardFall extends into the shell-guard layer specifically.

## MITRE ATT&CK

- T1587 Develop Capabilities
- T1608 Stage Capabilities
- T1195 Supply Chain Compromise
- T1059 Command and Scripting Interpreter
- T1554 Compromise Host Software Binary
- T1548 Abuse Elevation Control Mechanism
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1485 Data Destruction
- T1561 Disk Wipe
- T1565 Data Manipulation

## Sources

- [GuardFall Exposes Open-Source AI Coding Agents to Decades-Old Shell Injection Risks](https://thehackernews.com/2026/06/guardfall-exposes-open-source-ai-coding.html)
- [AI coding agents vulnerability: GuardFall shell injection](https://adversa.ai/blog/opensource-ai-coding-agents-shell-injection-vulnerability/)
- [GuardFall Flaw Hits 10 of 11 Popular Open-Source AI Agents](https://securityaffairs.com/194546/ai/guardfall-flaw-hits-10-of-11-popular-open-source-ai-agents.html)
- [GuardFall Shell Injection Bypass Affects Most Open-Source AI Coding Agents](https://www.mallory.ai/stories/019f1cce-b0d1-74aa-9190-6d9f06c5ca26)
- [Shell injection flaw found in 10 of 11 open-source AI agents](https://www.scworld.com/brief/shell-injection-flaw-found-in-10-of-11-open-source-ai-agents)
- [Decades-Old Bash Tricks Expose AI Coding Agents to Supply Chain Attacks](https://www.securityweek.com/decades-old-bash-tricks-expose-ai-coding-agents-to-supply-chain-attacks/)
- [Simple shell tricks bypass AI agent security](https://cybernews.com/security/ai-agent-guards-fail-vulnerability-study/)
- [Decades-Old Bash Tricks Expose AI Coding Agents To Supply Chain Attacks (Slashdot discussion)](https://linux.slashdot.org/story/26/07/04/0325244/decades-old-bash-tricks-expose-ai-coding-agents-to-supply-chain-attacks)
- [AI agent poisoning, Langflow RCE exploited (daily briefing)](https://defend.network/briefings/ai-agent-poisoning-microsoft-langflow-rce-cryptojacking-2026-07-01.html)
- [Top Agentic AI security resources — July 2026](https://adversa.ai/blog/top-agentic-ai-security-resources-july-2026/)
- [TrustFall: coding agent security flaw enables one-click RCE in Claude, Cursor, Gemini CLI and GitHub Copilot](https://adversa.ai/blog/trustfall-coding-agent-security-flaw-rce-claude-cursor-gemini-cli-copilot/)
- [One keypress is all it takes to compromise four AI coding tools](https://www.helpnetsecurity.com/2026/05/07/trustfall-ai-coding-cli-vulnerability-research/)
- [TrustFall turns AI coding-agent folder trust into code execution](https://vibegraveyard.ai/story/trustfall-ai-coding-agents-mcp-rce/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1131