How GuardFall Works

GuardFall exploits the gap between how a safety checker reads a command and how Bash actually interprets it. AI coding agents often pass LLM-generated shell commands through a text-based safety filter that looks for dangerous strings. But when the command reaches the real shell, Bash applies parsing rules — including quote removal and $IFS (Internal Field Separator) spacing — that can transform the obfuscated command into something dangerous .

An attacker can embed these obfuscated commands in content the agent ingests, such as a poisoned README or Makefile. The safety layer sees a harmless-looking string, but Bash executes something like rm -rf / or silently exfiltrates AWS credentials .

The issue is structural. The safety checker evaluates commands as plain text, while the shell runs them through a parser built over 40 years ago. That mismatch is what GuardFall exploits .

Affected Tools

According to the available reporting, the following open-source agents were among those affected by GuardFall :

• opencode
• Roo-Code
• Hermes
• Other tested open-source agents — GuardFall reportedly affected 10 of 11 agents overall

The one tool that successfully blocked all test bypasses was Continue .

Recommended Mitigations

Because the problem is a parsing mismatch rather than a simple blocklist gap, Adversa AI and other analysts recommend a layered approach :

1. Don't rely on string-pattern safety filters alone. Safety checks that scan for obvious dangerous strings can be bypassed when Bash interprets obfuscated syntax differently from the checker .
2. Treat the shell boundary as high risk. Commands assembled from model output or repository content should be reviewed, escaped, or avoided where possible before they reach Bash .
3. Reduce blast radius. Run AI coding agents with the least privilege practical for the task, especially when they are operating on cloned repositories or other external content.
4. Apply vendor patches when available. Related AI coding-agent vulnerabilities have been fixed in some cases, including Google's patch for a maximum-severity Gemini CLI issue tracked as GHSA-wpqr-6v78-jr5g .
5. Manually review agent-suggested commands before execution in sensitive environments.
6. Treat external content such as READMEs and code files as untrusted, because GuardFall-style attacks rely on malicious content being ingested by the agent .

Adversa AI also recommends that maintainers adopt a tokenize-and-canonicalize approach for command safety checks rather than simple string matching .

Broader Industry Concerns — June 2026

GuardFall was not disclosed in isolation. June 2026 reporting documented multiple coordinated vulnerability disclosures that suggested many AI coding agents share similar structural weaknesses around trust, command execution, and workspace content .

Related Vulnerability Classes

• TrustFall — Opening a malicious repository in tools such as Claude Code, Cursor, Gemini CLI, or GitHub Copilot and accepting the trust prompt was reported as enough to run attacker code that could reach sensitive local data such as SSH keys, cloud credentials, and shell history .
• SymJack — A symlink-hijack RCE class was reported as a quieter attack pattern affecting multiple agents, including Claude Code, Cursor, Antigravity, Copilot CLI, and Grok Build .
• Gemini CLI CVSS 10.0 — Google patched a maximum-severity vulnerability in Gemini CLI, tracked as GHSA-wpqr-6v78-jr5g, where headless CI/CD execution automatically trusted attacker-controlled workspace files and allowed arbitrary command execution on CI/CD build runners .

Key Structural Concerns

• Prompt injection remains a central risk for agentic coding tools. NIST has characterized prompt injection as "generative AI's greatest security flaw," and OWASP ranks it as the top vulnerability in its LLM Applications Top 10 .
• Trust prompts are not enough by themselves. TrustFall-style reporting described attacker code execution after a user accepted a repository trust prompt .
• Text-based command safety checks are not a complete security boundary. GuardFall-style attacks rely on Bash interpreting obfuscated command strings differently from the safety layer .
• Vendor response has been uneven. Reporting stated that Google and Cursor declined to patch TrustFall/SymJack-style issues, while xAI and GitHub Copilot CLI did not respond to researchers .

The common theme is that the approval prompts and text-based filters that AI coding agents lean on for safety are not designed to withstand a motivated attacker who understands how the shell actually works .

How GuardFall Works

GuardFall exploits the gap between how a safety checker reads a command and how Bash actually interprets it. AI coding agents often pass LLM-generated shell commands through a text-based safety filter that looks for dangerous strings. But when the command reaches the real shell, Bash applies parsing rules — including quote removal and $IFS (Internal Field Separator) spacing — that can transform the obfuscated command into something dangerous .

An attacker can embed these obfuscated commands in content the agent ingests, such as a poisoned README or Makefile. The safety layer sees a harmless-looking string, but Bash executes something like rm -rf / or silently exfiltrates AWS credentials .

The issue is structural. The safety checker evaluates commands as plain text, while the shell runs them through a parser built over 40 years ago. That mismatch is what GuardFall exploits .

Affected Tools

According to the available reporting, the following open-source agents were among those affected by GuardFall :

• opencode
• Roo-Code
• Hermes
• Other tested open-source agents — GuardFall reportedly affected 10 of 11 agents overall

The one tool that successfully blocked all test bypasses was Continue .

Recommended Mitigations

Because the problem is a parsing mismatch rather than a simple blocklist gap, Adversa AI and other analysts recommend a layered approach :

1. Don't rely on string-pattern safety filters alone. Safety checks that scan for obvious dangerous strings can be bypassed when Bash interprets obfuscated syntax differently from the checker .
2. Treat the shell boundary as high risk. Commands assembled from model output or repository content should be reviewed, escaped, or avoided where possible before they reach Bash .
3. Reduce blast radius. Run AI coding agents with the least privilege practical for the task, especially when they are operating on cloned repositories or other external content.
4. Apply vendor patches when available. Related AI coding-agent vulnerabilities have been fixed in some cases, including Google's patch for a maximum-severity Gemini CLI issue tracked as GHSA-wpqr-6v78-jr5g .
5. Manually review agent-suggested commands before execution in sensitive environments.
6. Treat external content such as READMEs and code files as untrusted, because GuardFall-style attacks rely on malicious content being ingested by the agent .

Adversa AI also recommends that maintainers adopt a tokenize-and-canonicalize approach for command safety checks rather than simple string matching .

Broader Industry Concerns — June 2026

GuardFall was not disclosed in isolation. June 2026 reporting documented multiple coordinated vulnerability disclosures that suggested many AI coding agents share similar structural weaknesses around trust, command execution, and workspace content .

Related Vulnerability Classes

• TrustFall — Opening a malicious repository in tools such as Claude Code, Cursor, Gemini CLI, or GitHub Copilot and accepting the trust prompt was reported as enough to run attacker code that could reach sensitive local data such as SSH keys, cloud credentials, and shell history .
• SymJack — A symlink-hijack RCE class was reported as a quieter attack pattern affecting multiple agents, including Claude Code, Cursor, Antigravity, Copilot CLI, and Grok Build .
• Gemini CLI CVSS 10.0 — Google patched a maximum-severity vulnerability in Gemini CLI, tracked as GHSA-wpqr-6v78-jr5g, where headless CI/CD execution automatically trusted attacker-controlled workspace files and allowed arbitrary command execution on CI/CD build runners .

Key Structural Concerns

• Prompt injection remains a central risk for agentic coding tools. NIST has characterized prompt injection as "generative AI's greatest security flaw," and OWASP ranks it as the top vulnerability in its LLM Applications Top 10 .
• Trust prompts are not enough by themselves. TrustFall-style reporting described attacker code execution after a user accepted a repository trust prompt .
• Text-based command safety checks are not a complete security boundary. GuardFall-style attacks rely on Bash interpreting obfuscated command strings differently from the safety layer .
• Vendor response has been uneven. Reporting stated that Google and Cursor declined to patch TrustFall/SymJack-style issues, while xAI and GitHub Copilot CLI did not respond to researchers .

The common theme is that the approval prompts and text-based filters that AI coding agents lean on for safety are not designed to withstand a motivated attacker who understands how the shell actually works .