A critical security vulnerability class called GuardFall undermines the safety mechanisms protecting AI coding agents from malicious commands, with 10 of 11 surveyed agents vulnerable to exploitation using shell tricks from the 1990s. Security researchers at Adversa AI discovered that the pattern-matching filters designed to block dangerous commands in popular open-source AI agents like Hermes Agent, OpenCode, and Goose can be bypassed using well-known shell quoting techniques, allowing attackers to execute arbitrary code with full account privileges.

The core problem stems from a fundamental mismatch: guards inspect raw command text before it reaches the shell, but bash processes that text through expansion, unquoting, and rewriting before execution. This means a command can pass inspection and then transform into something dangerous once the shell processes it. The researchers first discovered this vulnerability in the NousResearch/Hermes-Agent project, which triggered a broader investigation into how the most popular coding agents handle shell security.

How Do These Shell Injection Bypasses Actually Work?

• Quote Removal: The shell strips adjacent quote pairs from words before processing them. A command like r''m appears safe to a regex filter but becomes rm once bash removes the quotes, bypassing guards that look for the literal rm command.
• Field Separator Expansion: Using bash's Internal Field Separator variable, attackers can write rm$IFS-rf$IFS/ which looks like one word to a filter but expands into three separate arguments (rm, -rf, /) that execute destructive commands.
• Command Substitution: Embedding commands within substitution syntax like $(echo rm) -rf / hides the actual binary name from pattern matchers until bash evaluates the expression.
• Base64 Encoding: Piping encoded payloads through base64 decoders and shell interpreters (echo payload | base64 -d | sh) obscures malicious content across multiple commands that individually appear harmless.
• Alternative Command Flags: Using different command-line options that achieve the same destructive effect, such as find /x -delete or dd of=/dev/sda, circumvent guards focused on specific dangerous patterns.

The research surveyed 11 of the most popular open-source coding and computer-use agents by GitHub activity, including Continue, Cline, Goose, OpenCode, Aider, OpenInterpreter, and others representing roughly 548,000 combined GitHub stars. The findings reveal four distinct architectural failures across these tools.

What Are the Different Types of Security Failures?

Three agents, including Hermes Agent, ship a guard that exists but can be defeated by the bypass classes. Two agents use a tokenized guard that only leaks when quoted substitution and destructive flags are combined. Several others ship no static guard at all, relying instead on container sandboxes that fail under documented local mode opt-outs. Only one agent, Continue, implements a correctly structured guard that closes the majority of the bypass surface in its default configuration.

The researchers conducted live end-to-end penetration tests using Claude Sonnet 4.6, a frontier language model, against realistic attack vectors including malicious MCP servers, injected README files, Makefile targets, and shipped configuration files. OpenCode failed 16 out of 16 test cases, while Goose failed 22 out of 23 cases. Cline showed different results depending on configuration, leaking in 2 out of 13 cases with allow-and-deny mode enabled and 8 out of 13 cases in deny-only mode.

The danger lies not just in the technical vulnerability but in the false confidence these guards create. When developers see a filter in place, they feel safe enough to disable human-in-the-loop oversight and switch on full automation. Yet the filter provides confidence without actual protection. An AI agent processing untrusted content, such as a poisoned npm package README or a malicious Makefile, can be tricked by a frontier language model into emitting injected commands as routine operational tasks.

The researchers emphasize that this is not a bug in any single agent but rather a dangerous convention and class of problems affecting the entire category. Adding more patterns to denial lists cannot close these structural vulnerabilities because the fundamental issue is that pattern matching on raw text cannot model how bash actually processes commands. The solution requires architectural changes at the agent-to-bash boundary, not incremental filter improvements.

For teams currently using AI coding agents in production, the research identifies Continue as the reference design that properly closes the structural majority of the bypass surface when running in its default IDE mode. This is the only sound defense for the configuration most developers actually use: an agent running on the host machine with access to real home directories and non-disposable workspaces. The alternative approach, using disposable container sandboxes, is sound only if the workspace can be thrown away after each run.

The implications extend beyond individual tool choices. The research reveals that the boundary between what an AI agent emits and what bash executes is structurally underbuilt across the entire ecosystem. As AI agents become more autonomous and handle more sensitive operations, this architectural gap represents a critical risk for enterprises deploying these tools in production environments with real credentials and sensitive data access.