Researchers at Adversa AI have identified a bypass technique, dubbed GuardFall, that exploits a public shell trick from decades ago to circumvent safety checks in AI coding agents. The attack works against ten of eleven popular open-source coding and computer-use agents, leaving only the tool "Continue" unaffected.
The vulnerability exposes these agents to severe risks, as GuardFall can turn malicious repositories into vectors for supply chain attacks. By tricking an agent into executing dangerous commands, attackers could inject malware into codebases or exfiltrate sensitive data during automated coding tasks.
Technically, the bypass leverages well-known shell escaping methods that have been documented for decades. The safety mechanisms in these agents fail to properly sanitize commands, allowing an attacker to craft input that slips past validation and executes arbitrary shell operations on the host system.
No vendor patches have been announced at this time. Organizations using any of the affected open-source agents—other than "Continue"—should restrict their use to trusted repositories only and monitor for updates from the respective projects. The researchers have not yet released a full list of the ten vulnerable agents.
Attribution for the discovery points to the research firm Adversa AI. The finding highlights a broader challenge: as AI-powered coding tools proliferate, legacy security flaws in system-level interactions remain a potent attack surface.