Breaking

GuardFall: 10 of 11 Open-Source AI Coding Agents Fail Shell-Injection Guards

July 2, 2026 at 01:46 EDT

Security
AI Agents
Open Source

Security firm Adversa AI reported on June 30, 2026, that 10 of 11 open-source AI coding and computer-use agents are affected by "GuardFall," a class of vulnerabilities that bypasses shell-command safety guards. Via a poisoned repository or package, it can lead to destructive command execution under the user's full account privileges.

Security Analysis · Adversa AI

"GuardFall" Bypasses AI Coding Agent Safety Filters — 10 of 11 Fall

Decades-old shell injection tricks slip past text-based command filters, because a string judged "safe" expands into a dangerous command the moment Bash actually runs it.

10/11

open-source agents bypassed

~548k

combined GitHub stars of tools tested

A–E

five bypass classes, each with variants

Filter leaks found during probing

16/16

opencode

22/23

Goose

Each block = one probe attempt · lighter block = the single case that held

Defended — Continue

In default IDE mode it parses and evaluates commands as Bash would truly execute them, then applies a hard block list for destructive commands.

Bypassed — 10 others

Hermes · opencode · Goose · Cline · Roo-Code · Aider · Plandex · Open Interpreter · OpenHands · SWE-agent — all relied on text-only denylist matching.

Why a "safe" string turns dangerous

Text filter: "looks safe"

→

Bash expansion: $IFS, substitution, quote removal

→

Dangerous command runs

Recommended mitigations

Agents run shell commands with the user's own privileges — exposing SSH keys, cloud credentials and $HOME files, especially when auto-exec is on or the sandbox is off.

Switch $HOME to a throwaway folder
Disable auto-exec flags
Ban agent execution from fork PRs
Treat in-repo config files (README, Makefile, MCP responses) as untrusted

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.