GuardFall Flaw Hits 10 of 11 Popular Open-Source AI Agents

Researchers found a structural shell-injection weakness (GuardFall) in 10 of 11 popular open-source AI agents where guards that string-match raw commands can be bypassed by shell expansions, command substitutions, IFS tricks, base64 piping, and alternative destructive utilities; this can lead to arbitrary command execution with the operator's account authority (SSH keys, cloud credentials). The report categorizes five bypass classes, demonstrates live confirmations (including host execution when container protections are disabled), highlights that only one agent (Continue) implements a largely effective tokenize-and-evaluate approach, and recommends mitigations such as scoped shells, repository config audits, disabling auto-execute, and adopting tokenize-and-canonicalize evaluators.