Breaking

Bash Parsing Quirk Bypasses Command Guards in 10 of 11 AI Coding Agents

June 30, 2026 at 10:34 EDT

Security
AI Agents
Open Source

Security firm Adversa AI on June 30, 2026 disclosed a vulnerability class dubbed "GuardFall" that bypasses the command checks used by open-source AI coding agents by exploiting how the Bash shell parses commands. The bypass succeeded against 10 of the 11 agents tested.

June 30, 2026 · Adversa AI

"GuardFall": 30-Year-Old Bash Tricks Defeat AI Coding Agent Guards

A guard inspects the raw text of a command — but Bash expands it at runtime. Writing r''m slips past a regex denylist and runs as rm. 10 of 11 tested open-source agents failed to block it.

10/11

agents bypassed; only Continue structurally defended

548k

combined GitHub stars across tested agents

30+ yrs

age of the shell quoting bypasses reused here

Agents bypassed vs. defended

Each block = one tested agent.

Bypassed

Defended (Continue)

Bypassed: Hermes · opencode · Goose · Cline · Roo-Code · Aider · Plandex · Open Interpreter · OpenHands · SWE-agent. Continue won by combining tokenization + normalization instead of raw-string regex.

Five bypass classes — same goal, different disguise

A Quote removal r''m

B $IFS substitution $IFS

C Command substitution $(echo rm)

D Base64 pipe base64 … | sh

E Alternate destructive argv — defeated the most guards find … -delete

1 · INJECT

Command hidden in a README, Makefile, or MCP response

→

2 · GUARD READS

Regex sees harmless r''m, allows it

→

3 · BASH RUNS

Quote removal restores rm at full privilege

Immediate mitigations

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.