GuardFall: When Decades-Old Shell Injection Tricks Beat Modern AI Safety Guardrails

Short summary

GuardFall exploits how AI coding agents construct commands: safety checks inspect tool arguments before execution, but shell metacharacters, command substitution ($(...)), and variable expansion tricks get reinterpreted by the shell afterward, bypassing guardrails entirely. Adversa AI tested 11 popular open-source agents and found 10 vulnerable to decades-old shell injection—only Continue resisted. Defense requires out-of-band scrubbing layers that validate and normalize tool results independently before the agent sees them, not self-validation inside agent reasoning.

• •10 of 11 AI coding agents vulnerable to shell injection attacks due to safety check gaps in architecture
• •Attackers inject commands via metacharacters and command substitution after agent-level validation passes
• •Requires independent out-of-band inspection layers, not agent self-validation

Generated with AI, which can make mistakes.