AI coding agents have a safety check meant to stop them from running dangerous commands. A researcher just proved you can walk right past it using a shell trick that’s been public for decades.
Adversa AI calls the bypass GuardFall. They tested eleven popular open-source coding and computer-use agents. Ten of them failed. Only one — “Continue” — was built to defend against it.
The problem is simple. These agents check commands as plain text against a blocklist. But bash doesn’t read text the same way. The shell strips quotes and expands shortcuts. The filter sees one thing. Bash runs another.
Example: a filter watching for “rm” sees nothing wrong with “r”m”. Bash removes the empty quotes and runs rm anyway. Same trick works with base64 commands, or using tools like find and dd with the right flags.
Two things need to line up for an attack. First, the AI has to generate the malicious command — often tucked inside a build file or tool documentation. Second, the agent has to be running with auto-execute enabled. Both are routine in automated pipelines.
The vulnerable tools: opencode, Goose, Cline, Roo-Code, Aider, Plandex, Open Interpreter, OpenHands, SWE-agent, and the Hermes project. Together they hold roughly 548,000 GitHub stars.
Adversa recommends running agents with $HOME pointed at a throwaway folder so SSH keys and cloud credentials are out of reach. Turn off auto-execute flags. Don’t let agents run on pull requests from forks. Treat config files shipped inside a repository as untrusted code.
