GuardFall Bypasses Defeat 10 of 11 AI Coding Agents via 1989 Bash Obfuscation

Adversa documented five bypass classes against pattern-based denylists in agents surveyed by GitHub activity through May 2026. Class E survived the strongest tokenized guards because per-binary flag reasoning exceeds simple regex scope. Only Continue downgraded all 12 canonical-destructive cases and blocked 21 submitted bypasses, though Class C quoted arguments and long-tail argv variants remain open. The attack chain requires indirect prompts inside ingested files rather than direct malicious instructions, exploiting the gap between guard evaluation and subsequent shell expansion.

These failures expose a structural mismatch: agents inherit full user context yet rely on surface-level input sanitization that Bourne shell semantics have defeated since 1989. Procurement records and CI defaults favoring auto-yes modes amplify the blast radius to credential exfiltration or environment wipes without requiring model collusion on overt harm. Mainstream coverage treats this as isolated agent bugs rather than pipeline architecture debt.

Independent confirmation is limited to the Adversa technical report; no CVE exists yet because the issue is a guard design pattern, not a single code defect. Related patterns appear in prior MCP server and tool-use injection studies from 2025. Maintainers must shift from denylist iteration to argv canonicalization and least-privilege execution contexts.

Next milestones include patch releases from the ten affected projects and potential addition of GuardFall test suites to agent evaluation benchmarks within the next two release cycles.