Adversa AI discloses GuardFall: a universal shell injection vulnerability in open-source AI coding agents

Adversa AI discloses a class of universal shell injection vulnerabilities called GuardFall, noting that guardrails based on pattern matching of raw command strings cannot model bash's expansion behavior and thus can be bypassed even when fully enabled and correctly configured. The research covered 11 open-source coding and computer-use agents (totaling approximately 548,000 GitHub stars), of which 10 had exploitable agent-to-bash boundaries, falling into four failure modes: three had guardrails present but bypassed (Hermes, opencode, Goose), two tokenized guardrails failed only on in-quote command substitution and destructive arguments, and the rest either had no static guardrails or their default container sandbox failed after the documented local mode was exited.