GuardFall Exposes Open-Source AI Coding Agents to Decades-Old Shell Injection Risks

The safety check that is supposed to stop an AI coding agent from running a dangerous command can be walked straight past using a shell trick that has been public for decades. New research from Adversa AI, which is named the bypass GuardFall, found it works against ten of the eleven popular open-source coding and computer-use agents the firm tested. Only one, "Continue," was built to

According to Adversa AI’s GuardFall research, decades-old Bash shell rewriting tricks can bypass safety checks in 10 of 11 popular open-source AI coding and computer-use agents, allowing shell injection even when command filters or allowlists are in place.[1][5] These agents often run with full user account access and in automated pipelines, so a successful GuardFall exploit can escalate from a single malicious file or config (e.g., in a pull request or repo-shipped config) into supply chain compromise and secret theft such as SSH keys and cloud credentials.[1][5][6] From a CyberSE.AI perspective, this demonstrates AI agent abuse risks and AI supply chain exposure in real-world tools, highlighting the need to redesign agent execution models (no blind auto-exec, strict sandboxing, minimal privileges) and to continuously red-team agents against command-rewriting and injection bypass techniques. Organizations should also treat repo-level configs and PR-originated instructions as untrusted inputs, incorporate GuardFall-style test cases in Secure AI Agent Build and AI Agent Business Logic Audit, and extend SBOM and supply chain monitoring to include AI coding agents embedded in CI/CD wo