Blab AI
GuardFall Exposes Shell-Injection Vulnerabilities in Most Open-Source AI Coding Agents
Adversa AI’s latest survey, released on July 1 2026, turns a quiet line of code into a warning bell. The study—GuardFall: a universal shell injection vulnerability in open‑source AI agents—examines eleven popular open‑source AI coding and computer‑use agents and finds that ten of them let a shell command slip past their built‑in execution filters. Only the agent Continue withstood all the tested bypasses.
The agents assessed—Hermes, opencode, Goose, Cline, Roo‑Code, Aider, Plandex, Open Interpreter, OpenHands, SWE‑agent, and Continue—collectively boast roughly 548,000 GitHub stars. Adversa’s investigation was sparked by a discovery in Hermes, where a cleverly rewritten shell command could defeat a 30‑pattern regex denylist. From there the researchers expanded their test suite to the other agents, revealing a common structural flaw.
At its core, the problem lies in a long‑standing mismatch in security literature. Most agents compare the raw command string supplied by the language model to a list of dangerous patterns. However, the shell (bash) rewrites that string before execution, performing quote removal, parameter expansion, command substitution, and field splitting. If an agent’s guard only inspects the unexpanded text, a prompt injection can produce a command that passes the guard yet executes a destructive operation.
Adversa identified five bypass classes:
1. Class A – quoting the binary name (e.g., r''m instead of rm). The guard never matches, but bash removes the quotes and runs rm. 2. Class B – inserting an internal field separator ($IFS) between the command and its arguments (e.g., rm$IFS‑rf$IFS/). The guard sees a single word, but bash expands $IFS to whitespace, creating multiple arguments. 3. Class C – placing the binary name inside a command substitution ($(echo rm) -rf /). The guard matches the substitution expression, not the binary. 4. Class D – piping a base64‑encoded payload through sh. Each segment is benign, but the combined command is destructive. 5. Class E – using alternative utilities that become destructive with specific flags (e.g., find /x -delete, dd of=/dev/sda, install -m 4755 payload /usr/local/bin/backdoor). A guard that blocks rm -rf misses these.
The survey found that Hermes, opencode, and Goose rely on a regex guard that blocks rm -rf but fails on the bypass variants. Goose leaked 22 of 23 test cases; opencode leaked all 16. Two agents employ a tokenized guard that improves coverage by handling quote removal and $IFS variants, yet it still fails on command substitutions inside quoted arguments and on Class E patterns.
The remaining agents ship no static guard, relying on human confirmation before each command. This approach is safe only until the operator enables auto‑execution—a common practice in continuous‑integration pipelines. Some agents allow a repository‑level configuration file to enable auto‑test, potentially triggering a payload on the first accepted edit.
Sandboxing does not help either. All sandboxed agents in the survey include a local‑mode configuration that disables the container and runs commands directly on the host. Adversa’s live tests against SWE‑agent and OpenHands in local mode confirmed that destructive commands execute on the host.
Continue takes a different tack. It tokenizes the command using shell-quote before any matching, detects variable expansion tokens such as $IFS, evaluates command substitutions recursively, checks for pipe segments that end in a shell interpreter, and maintains an explicit disabled list for canonical destructive patterns. In 21 bypass cases, none passed unrestricted execution; all 12 canonical‑destructive cases were blocked. The report notes that the remaining gaps—Class C inside a quoted argument and the long tail of Class E—are addressable through an enumerated disabled list.
Adversa recommends several short‑term mitigations. Running agents from a scoped shell that redirects $HOME keeps SSH keys, cloud credentials, and shell history out of the agent’s reach. Auditing repository configuration files before allowing an agent to read them can prevent auto‑test payloads. Disabling auto‑yes flags in CI and turning off agent execution on fork pull requests are also advised.
The study concludes that a guard that only string‑matches raw commands is structurally unsafe. Until tokenization and canonicalization become the default, any agent that relies on a regex guard remains one prompt injection away from granting an attacker full account authority.
These findings underscore the need for a security convention that aligns guard logic with shell semantics, especially as open‑source AI coding agents become more widely deployed in production environments.
The agents assessed—Hermes, opencode, Goose, Cline, Roo‑Code, Aider, Plandex, Open Interpreter, OpenHands, SWE‑agent, and Continue—collectively boast roughly 548,000 GitHub stars. Adversa’s investigation was sparked by a discovery in Hermes, where a cleverly rewritten shell command could defeat a 30‑pattern regex denylist. From there the researchers expanded their test suite to the other agents, revealing a common structural flaw.
At its core, the problem lies in a long‑standing mismatch in security literature. Most agents compare the raw command string supplied by the language model to a list of dangerous patterns. However, the shell (bash) rewrites that string before execution, performing quote removal, parameter expansion, command substitution, and field splitting. If an agent’s guard only inspects the unexpanded text, a prompt injection can produce a command that passes the guard yet executes a destructive operation.
Adversa identified five bypass classes:
1. Class A – quoting the binary name (e.g., r''m instead of rm). The guard never matches, but bash removes the quotes and runs rm. 2. Class B – inserting an internal field separator ($IFS) between the command and its arguments (e.g., rm$IFS‑rf$IFS/). The guard sees a single word, but bash expands $IFS to whitespace, creating multiple arguments. 3. Class C – placing the binary name inside a command substitution ($(echo rm) -rf /). The guard matches the substitution expression, not the binary. 4. Class D – piping a base64‑encoded payload through sh. Each segment is benign, but the combined command is destructive. 5. Class E – using alternative utilities that become destructive with specific flags (e.g., find /x -delete, dd of=/dev/sda, install -m 4755 payload /usr/local/bin/backdoor). A guard that blocks rm -rf misses these.
The survey found that Hermes, opencode, and Goose rely on a regex guard that blocks rm -rf but fails on the bypass variants. Goose leaked 22 of 23 test cases; opencode leaked all 16. Two agents employ a tokenized guard that improves coverage by handling quote removal and $IFS variants, yet it still fails on command substitutions inside quoted arguments and on Class E patterns.
The remaining agents ship no static guard, relying on human confirmation before each command. This approach is safe only until the operator enables auto‑execution—a common practice in continuous‑integration pipelines. Some agents allow a repository‑level configuration file to enable auto‑test, potentially triggering a payload on the first accepted edit.
Sandboxing does not help either. All sandboxed agents in the survey include a local‑mode configuration that disables the container and runs commands directly on the host. Adversa’s live tests against SWE‑agent and OpenHands in local mode confirmed that destructive commands execute on the host.
Continue takes a different tack. It tokenizes the command using shell-quote before any matching, detects variable expansion tokens such as $IFS, evaluates command substitutions recursively, checks for pipe segments that end in a shell interpreter, and maintains an explicit disabled list for canonical destructive patterns. In 21 bypass cases, none passed unrestricted execution; all 12 canonical‑destructive cases were blocked. The report notes that the remaining gaps—Class C inside a quoted argument and the long tail of Class E—are addressable through an enumerated disabled list.
Adversa recommends several short‑term mitigations. Running agents from a scoped shell that redirects $HOME keeps SSH keys, cloud credentials, and shell history out of the agent’s reach. Auditing repository configuration files before allowing an agent to read them can prevent auto‑test payloads. Disabling auto‑yes flags in CI and turning off agent execution on fork pull requests are also advised.
The study concludes that a guard that only string‑matches raw commands is structurally unsafe. Until tokenization and canonicalization become the default, any agent that relies on a regex guard remains one prompt injection away from granting an attacker full account authority.
These findings underscore the need for a security convention that aligns guard logic with shell semantics, especially as open‑source AI coding agents become more widely deployed in production environments.
