{"schema_version":"0.10.0","id":"LR-2026-0593","record_version":1,"title":"GuardFall: shell-trick bypass of AI coding agent command guards","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":46.6,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":3.2,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: The Hacker News · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: The Hacker News · subject to change"}]},"sources_hash":"b8aef603ec5e5042723922b04a0f197f00f475e3a0907397bcd3ac87f6af6503"},"system":{"model_name":"Claude Sonnet 4.6","model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":"full account access","autonomy_level":"unknown","guardrails_present":["blocklist of dangerous patterns"],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-06-30","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"public_researcher","summary":"Open-source AI coding and computer-use agents run shell commands with the user's account access, and they screen each command against a blocklist of dangerous patterns before running it. Adversa AI researchers found that a shell trick, such as splitting a command with empty quotes, lets dangerous commands pass the check because the filter reads plain text while bash rewrites it before execution. The bypass, named GuardFall, worked against ten of the eleven tools tested, and Continue was the one built to defend against it. Adversa demonstrated the full attack against the Plandex binary, and the same shape worked against eight others. The work was described as lab research, and no public exploitation has been reported. Adversa said adding more blocklist patterns would not fix the underlying class of problem.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"negligible","severity_because":"Test: no effect beyond the system itself. Fact: the work is described as lab research and no public exploitation has been reported.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://thehackernews.com/2026/06/guardfall-exposes-open-source-ai-coding.html","publisher":"The Hacker News","date":"2026-06-30","type":"press","title":"GuardFall Exposes Open-Source AI Coding Agents to Decades-Old Shell Injection Risks - The Hacker News","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"system.model_name":"C","system.permissions_scope":"C","system.guardrails_present":"C","event.detection_method":"C","event.incident_class":"D","impact.severity_because":"D","impact.severity":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.model_name":[{"source_index":0,"quote":"The live tests used Claude Sonnet 4.6."}],"system.permissions_scope":[{"source_index":0,"quote":"These agents run shell commands with your full account access."}],"system.guardrails_present":[{"source_index":0,"quote":"Most of these agents try to stay safe by checking each command against a blocklist of dangerous patterns before running it."}],"event.detection_method":[{"source_index":0,"quote":"New research from Adversa AI, which is named the bypass GuardFall, found it works against ten of the eleven popular open-source coding and computer-use agents the firm tested."}],"event.incident_class":[{"source_index":0,"quote":"Point one at a booby-trapped repository or software package, and a hidden instruction can quietly run a command that wipes files or steals the secrets your account can reach, from SSH keys and cloud credentials to anything sitting in your home folder."}],"impact.severity_because":[{"source_index":0,"quote":"It describes the work as lab research; no public exploitation has been reported."}],"impact.severity":[{"source_index":0,"quote":"It describes the work as lab research; no public exploitation has been reported."}],"event.summary":[{"source_index":0,"quote":"These agents run shell commands with your full account access."},{"source_index":0,"quote":"Most of these agents try to stay safe by checking each command against a blocklist of dangerous patterns before running it."},{"source_index":0,"quote":"The flaw is that they check the command as plain text, while bash rewrites that text before it actually runs."},{"source_index":0,"quote":"New research from Adversa AI, which is named the bypass GuardFall, found it works against ten of the eleven popular open-source coding and computer-use agents the firm tested."},{"source_index":0,"quote":"Adversa demonstrated the full attack end-to-end against the production Plandex binary, and the same shape worked against eight others."},{"source_index":0,"quote":"It describes the work as lab research; no public exploitation has been reported."}]},"notes_on_gaps":"The source is one press article on lab research by Adversa AI; no date of occurrence, no date of detection and no separate disclosure date are stated (the article date of 2026-06-30 is not treated as a disclosure date). The model developer and the agent harness are not named for the live tests. No real-world exploitation is reported, so no losses, record counts or affected parties are stated. Failure_class is left out because no autonomous agent failure class is stated for this bypass. Autonomy level is left unknown since the source says only that the agent runs on its own with auto-execute on. Trigger prompt_injection and the risks, controls and severity of negligible are my judgements from the described attack and the stated lab-only context. Adversa's own tool status for the other ten tools is given only as the gap being open; no controls were reported for them. Continue's auto-run mode was weaker, with some payloads slipping through, which the source states. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: The Hacker News · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"The coding and computer-use agents run shell commands with the user's full account access, after checking each command against a blocklist.","quote":"These agents run shell commands with your full account access.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/06/guardfall-exposes-open-source-ai-coding.html"]},"analysis":{"sections":{"timeline":[{"text":"The tools in the survey together carried roughly 548,000 GitHub stars.","quote":"The tools in Adversa's survey together carried roughly 548,000 GitHub stars as of May 2026.","source_index":0,"when":"2026-05"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/06/guardfall-exposes-open-source-ai-coding.html"]}}