"GuardFall" Shell-Injection Bypass in Open-Source AI Coding Agents

10 of 11 tested open-source AI coding and computer-use agents, including opencode, Goose, Cline, Roo-Code, Aider, Plandex, Open Interpreter, OpenHands, SWE-agent, and a NousResearch Hermes agent; only Continue mitigated it

Pattern-based command guards can be bypassed, so a poisoned README, MCP server, or Makefile can drive an agent into running destructive shell commands with the operator's full privileges, including wiping files or exfiltrating SSH keys and cloud credentials. Disclosed as lab research with no in-the-wild exploitation reported

Guards inspect the raw command string, but Bash performs quote removal, `$IFS` and parameter expansion, and command substitution before execution, so obfuscated commands slip past denylists; a decades-old shell-quoting bypass applied to AI agents. Found by Adversa AI (Omer Ben Simon)