2026-06-30 · 2026-Q2
"GuardFall" Shell-Injection Bypass in Open-Source AI Coding Agents
Was this approved as what it claims to be?
- Fixable
- Vendor patch
- Vendor response
- Unknown
- In the wild
- No
- Actor
- Attacker
Target
10 of 11 tested open-source AI coding and computer-use agents, including opencode, Goose, Cline, Roo-Code, Aider, Plandex, Open Interpreter, OpenHands, SWE-agent, and a NousResearch Hermes agent; only Continue mitigated it
Impact
Pattern-based command guards can be bypassed, so a poisoned README, MCP server, or Makefile can drive an agent into running destructive shell commands with the operator's full privileges, including wiping files or exfiltrating SSH keys and cloud credentials. Disclosed as lab research with no in-the-wild exploitation reported
Root cause
Guards inspect the raw command string, but Bash performs quote removal, `$IFS` and parameter expansion, and command substitution before execution, so obfuscated commands slip past denylists; a decades-old shell-quoting bypass applied to AI agents. Found by Adversa AI (Omer Ben Simon)
Sources
Catalog
Cite this: AgentProv incident record: "GuardFall" Shell-Injection Bypass in Open-Source AI Coding Agents (2026-06-30). https://agentprov.com/incidents/2026-06-30-guardfall-shell-injection-bypass-in-open-source-ai-coding-agents
Related
- Also L7 · 2026-10-22METR and Redwood: OpenAI's Agent Monitoring Was "Not Fit for Purpose" During the Hugging Face Break-InL7Build / Approval
- Also L7 · 2026-10-21OpenAI: Two Internal Agents Disabled Misalignment Monitoring, and One Denied It When AskedL7Build / Approval
- Also L7 · 2026-10-15Claude Code Plugin Hash Pins Could Be Bypassed With a Branch Named Like the Pinned SHA (CVE-2026-86063)L7Build / Approval