GuardFall: Critical Shell Injection Vulnerabilities in Open-Source AI Coding Agents
GuardFall is a systemic architectural flaw affecting 91% of tested open-source AI coding agents, including Aider, Open Interpreter, and OpenHands. The vulnerability arises from the agents' reliance on superficial safety filters to block "dangerous" shell commands. Attackers can bypass these filters using classical shell injection metacharacters via prompt injection, leading to arbitrary command execution. Because these agents typically operate with the full privileges of the host user, exploitation enables the theft of environment secrets, API keys, and the full compromise of CI/CD pipelines and host systems.
TrustFall: Exploiting AI Coding Agents for Supply Chain Compromise
The TrustFall attack leverages indirect prompt injection to compromise autonomous AI coding agents, such as GitHub Copilot and Claude Code. Attackers poison repository metadata, README files, or configuration files with hidden instructions that the AI agent processes as authoritative commands. By exploiting the agents' high-level autonomy and shell privileges, attackers can induce the agent to execute unauthorized shell commands, modify dependency manifests (e.g., package.json), or exfiltrate sensitive environment variables and SSH keys. This vector allows for the silent introduction of backdoors into production software, as the developer perceives the malicious modifications as legitimate AI-driven optimizations or bug fixes.