GuardFall is a systemic architectural flaw affecting 91% of tested open-source AI coding agents, including Aider, Open Interpreter, and OpenHands. The vulnerability arises from the agents' reliance on superficial safety filters to block "dangerous" shell commands. Attackers can bypass these filters using classical shell injection metacharacters via prompt injection, leading to arbitrary command execution. Because these agents typically operate with the full privileges of the host user, exploitation enables the theft of environment secrets, API keys, and the full compromise of CI/CD pipelines and host systems.

• Threat Model & Research Overview

  • Discovered by Adversa AI through a comprehensive security audit of 11 prominent open-source AI coding and "computer-use" agents.
  • Found a near-universal failure in safety mechanisms, with 10 out of 11 tools proving susceptible to exploitation.
  • Highlights a critical security gap where LLM-driven autonomy bypasses traditional operating system security boundaries.

• Vulnerability Mechanics: Deep Dive

  • Root cause is the evaluation of raw command strings without proper sanitization, parameterization, or escaping.
  • Agents utilize basic "deny-lists" of forbidden keywords to filter dangerous commands, which offer no protection against structural shell bypasses.
  • Classical shell injection techniques—using metacharacters such as ;, &&, ||, or backticks—allow attackers to append unauthorized payloads to legitimate-looking commands.

• Affected Agents & Attack Vector

  • Vulnerable tools include: opencode, Goose, Cline, Roo-Code, Aider, Plandex, Open Interpreter, OpenHands, SWE-agent, and Hermes.
  • Continue was the only agent in the study found to be resistant to these specific injection methods.
  • The primary attack vector involves prompt injection or manipulated input that tricks the LLM into generating a command containing shell-escape characters.

• Systemic & Security Impact

  • Arbitrary code execution occurs with the full account authority of the user executing the agent.
  • Immediate risk of exposure for sensitive environment variables, .env files, and cloud provider API keys stored on the host.
  • High potential for lateral movement within development environments and the unauthorized modification of source code in CI/CD pipelines.

• Mitigation & Conclusion

  • Development teams must transition from raw string evaluation to structured, parameterized API calls for all shell executions.
  • Deployment of strict sandboxing (e.g., Docker containers or gVisor) is mandatory to isolate agents from the host filesystem.
  • Security professionals should avoid relying on LLM-based "safety filters" as a primary defense against command injection.