Breaking

GuardFall Exploits Bash Parsing, Bypasses Defenses in 10 of 11 AI Coding Agents

June 30, 2026 at 10:29 EDT

Security
AI Agents
Software Dev & Coding

Security firm Adversa AI on June 30, 2026 disclosed "GuardFall," a vulnerability that lets attackers evade the text-based command defenses used by open-source AI coding agents by abusing Bash parsing and expansion. The bypass succeeded against 10 of the 11 agents tested.

June 30, 2026 · Adversa AI

"GuardFall" defeats the shell-command guards in AI coding agents

Decades-old Bash parsing tricks let destructive commands slip past text-based safety checks — collapsing into their true form only after the guard approves them. 10 of 11 tested open-source agents were vulnerable.

10/11

tested open-source agents found vulnerable

~548K

combined GitHub stars across the agents tested

0/21

bypass cases that worked against Continue (default IDE mode)

Result across the 11 agents tested

Each block = one agent. Only one blocked the attacks structurally.

Vulnerable

Blocked (Continue)

Continue's "tokenize-and-canonicalize" evaluator normalizes commands before evaluation — credited for its resilience.

Why text-based guards fail

Input seen by guard

r''m

looks harmless ✓

→

Bash quote removal

collapses

→

What actually runs

rm

destructive ✗

The command changes into its true form only after passing the guard — so inspection at the text stage alone cannot stop it.

Five classes of bypass

A Quote removal r''m · rm\

B $IFS expansion rm$IFS-rf$IFS/

C Command substitution $(echo rm) -rf /

D base64 decode-and-run … | base64 -d | sh

E Non-rm destructive cmds find -delete · dd

The core problem

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.