Cases › security breach › LR-2026-0593
GuardFall: shell-trick bypass of AI coding agent command guards
Preliminary Why: 1 report: The Hacker News · subject to change · 1 independent report
Status: no action reported
No source states: loss or records, agent tool, could do, deployer, industry.
Severity negligible: Test: no effect beyond the system itself. Fact: the work is described as lab research and no public exploitation has been reported.
Open-source AI coding and computer-use agents run shell commands with the user's account access, and they screen each command against a blocklist of dangerous patterns before running it. Adversa AI researchers found that a shell trick, such as splitting a command with empty quotes, lets dangerous commands pass the check because the filter reads plain text while bash rewrites it before execution. The bypass, named GuardFall, worked against ten of the eleven tools tested, and Continue was the one built to defend against it. Adversa demonstrated the full attack against the Plandex binary, and the same shape worked against eight others. The work was described as lab research, and no public exploitation has been reported. Adversa said adding more blocklist patterns would not fix the underlying class of problem.
What happened
What was done
No source states an action or fix.
Risks
Primary96 incidents
Rising: 24 vs 4.0 a week
Sorted by rule from the case's fields; not yet read from the sources.
Controls
Not yet read for controls. Controls that mitigate the primary risk:
ModelSafety training and refusal · Cyber and weapons safeguards · Abuse monitoring and account enforcement · Staged or restricted release · Dangerous-capability testing before release · Outside red-teaming · Content safety classifiers · Safeguards kept on in testing · Reasoning monitoring
Infrastructure / targetKnown flaws patched · Multi-factor sign-in and password policy · Network segmentation · Intrusion and endpoint detection · Backups and recovery · Phishing and fraud filters
Evidence
No source states: what went wrong, what it reached or did, how it was caught, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.
Model versions this case names
Each link opens what the provider's documents state for that version, who tested it, and the safeguards it describes.
Show the full account: 1 items from the primary sources
What happened, in order
- 2026-05 The tools in the survey together carried roughly 548,000 GitHub stars.
Show every field, with its source and grade
The AI system
What happened
Impact
Notes on gaps
No real-world exploitation is reported, so no losses, record counts or affected parties are stated. Continue's auto-run mode was weaker, with some payloads slipping through, which the source states.
LR-2026-0593 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON