GuardFall is Adversa AI's name for a class of shell injection against AI coding agents. An agent proposes a command, and a safety filter inspects the literal string before passing it to a shell. Variable expansion, command substitution, and glob resolution can transform that approved string into a different program at execution time.
Adversa AI tested eleven popular open-source coding agents and disclosed the results in late June 2026. Its test bypassed shell guards in ten.
| Agent | Result reported by Adversa |
|---|---|
| Hermes | Guard bypass reported |
| opencode | Guard bypass reported |
| Goose | Guard bypass reported |
| Cline | Guard bypass reported |
| Roo-Code | Guard bypass reported |
| Aider | Guard bypass reported |
| Plandex | Guard bypass reported |
| Open Interpreter | Guard bypass reported |
| OpenHands | Guard bypass reported |
| SWE-agent | Guard bypass reported |
| Continue | Blocked tested payloads in default editor mode; some CLI auto-run bypasses reported |
Adversa describes GuardFall as a class of failures rather than a single CVE. Deny-list updates can block known strings, but shell parsing and expansion create additional bypasses unless a guard evaluates commands using shell semantics.
Repository fixes reduce exposure, and Adversa also recommends disabling auto-execution for untrusted work and isolating agents from sensitive credentials. Coding agents may inherit SSH keys, cloud CLI sessions, package-registry tokens, git rights, and local credential files (The Hacker News; Security Affairs).
Run agents in containers or disposable virtual machines with scoped tokens, restricted egress, and accounts that cannot push to protected branches.
SC Media reported the same ten-of-eleven ratio. Continue blocked every tested payload in its default editor mode, although Adversa reported that some payloads bypassed its command-line auto-run mode. The test reflects the versions and configurations examined at the time.
Check whether updates parse commands using shell semantics or only add more blocked strings.
The Signal is the public edge of a private practice. Sherpa points the same intelligence engine at one owner's business — competitors, suppliers, regulators, watched daily, graded and sourced. Work with a Sherpa →