Adversa AI published research on 30 June showing that Aider, Cline, Goose, Open Interpreter, OpenHands, opencode, Plandex, Roo-Code, SWE-agent and NousResearch Hermes all share the same architectural flaw: they gate shell commands with string-matching filters that inspect the command as written, not as bash will actually interpret it. Attackers can hide a dangerous command inside quote removal, variable expansion or other decades-old bash behaviours so the filter sees something benign while bash executes something destructive. Only Continue, among the eleven agents tested, was built with a guard architecture that structurally closes the gap. Because these tricks can be planted in a README, a Makefile, or any other file an agent reads while working in a repo, the risk isn’t limited to commands a developer types directly — it extends to anything the agent ingests while doing routine work, including in CI pipelines running with auto-approve enabled.
This is the third distinct class of AI-coding-agent exploit we’ve flagged this month, after the symlink-based “GhostApproval” sandbox bypass and the README-based “Friendly Fire” social-engineering exploit. GuardFall is different from both: it’s not a one-off bug in one product, it’s a design pattern — agent talks to shell, gated by pattern matching — that fails the same way across nearly every open-source agent that uses it. Commercial, closed-source agents with more deliberate sandboxing (the kind most agencies build client work around) are less exposed, but “open source” and “cheaper” often go together for teams evaluating AI coding tools on cost alone.
So what
If anyone on your team — internal or a contractor — is running an open-source AI coding agent with auto-approve or CI access, this is worth an immediate check against Adversa’s list. More broadly, it’s a reason to ask any development partner how they isolate agent shell access, not just which AI tool logo is on the pitch deck. We treat that as a baseline requirement in AI-assisted development work — get in touch if you’d like your current setup reviewed against it.