GuardFall Exposes Open-Source AI Coding Agents to Decades-Old Shell Injection Risks

New research (GuardFall) shows a long-known shell trick can bypass AI coding agents' command-blocking safeguards by hiding destructive commands in forms that text-based filters miss but the shell executes, allowing commands like file deletion or secret exfiltration to run with the agent user's privileges; the bypass worked against 10 of 11 popular open-source agents tested, was demonstrated end-to-end against a production binary, and the researchers provide mitigations such as restricting HOME, disabling auto-execute, and treating repository config as untrusted.