GuardFall Bash Tricks Bypass Guards in Most Tested AI Coding Agents

Summary

Adversa AI reports that Bash obfuscation can bypass guards in 10 of 11 tested open-source AI agents, potentially enabling attacker-supplied commands to run with a developer’s authority under specific conditions.

Key points

Adversa AI calls GuardFall a structural weakness in shell guards: Bash can expand or rewrite commands after pattern-based checks allow them.
In tests of 11 open-source agents, 10 had gaps across four types of Bash tricks; Continue blocked the tested cases, though the researchers noted remaining limitations.
The researchers say exploitation depends on conditions such as model cooperation and auto-execution being enabled or a sandbox using local mode.
A poisoned README or Makefile could induce an agent to run commands that exfiltrate credentials or delete development environments, according to the researchers.
Suggested safeguards include running agents with a scoped HOME directory, disabling auto-yes modes, auditing repository configurations, and blocking execution on fork pull requests.
Adversa recommends agent-side tokenization and command canonicalization as a longer-term fix.

Article Details

Event Type: Research disclosure of GuardFall, a structural Bash-guard bypass affecting open-source AI coding agents.
Impact: Adversa AI found that 10 of 11 tested agents left the gap open in at least one of four ways; Continue was the only agent reported to block all tested tricks. Under conditions including model cooperation and auto-execution or local sandbox mode, poisoned content could prompt an agent to run destructive shell commands with the operator’s authority, potentially exfiltrating AWS credentials or wiping development environments, including in CI pipelines.

MITRE ATT&CK

T1059.004 · Unix ShellThe research describes disguised or obfuscated Bash commands being executed by coding agents when the relevant conditions are met.

People

Omer Ben SimonIdentified as Adversa AI’s lead researcher; he explained the agent testing and how Bash tricks could lead agents to execute commands.

Products

ContinueAdvertisement. Scroll to continue reading.Hermes“We tested eleven popular open source agents, including Hermes, OpenCode, Roo-code, and others,” explains Omer Ben Simon, lead researcher at Adversa AI.Hermes AgentThe trigger for the research was finding a NousResearch/hermes-agent approval gate bypass via shell rewrites against a 30-pattern regex denylist.OpenCode“We tested eleven popular open source agents, including Hermes, OpenCode, Roo-code, and others,” explains Omer Ben Simon, lead researcher at Adversa AI.Roo-code“We tested eleven popular open source agents, including Hermes, OpenCode, Roo-code, and others,” explains Omer Ben Simon, lead researcher at Adversa AI.