AI Security Briefing

What it is

Adversa AI's GuardFall research: a class of bypasses against pattern-based shell-command guards in 11 open-source AI coding/computer-use agents (surveyed as of May 2026, ~548,000 combined GitHub stars). It began with an approval-gate bypass in NousResearch/hermes-agent (commit 81cd67829) against a 30-pattern regex denylist (their failure ID F01).

How it works

The guard inspects the raw command string; bash then performs quote removal, parameter expansion, command substitution, $IFS splitting, etc. before execution. The inspected text and the executed text differ, so decades-old quoting bypasses pass the filter and get rewritten into the dangerous command at runtime. The load-bearing failure is conceptual, not incomplete: "adding more denylist patterns closes none of" the failure modes, because a string matcher cannot model bash expansion.

Preconditions / Affected

The realistic vector is prompt injection from operational context the agent ingests — poisoned README, Makefile target, shipped config, or malicious MCP server — not a direct malicious prompt (those are usually refused). Live runs used Claude Sonnet 4.6; the chain is model- and framing-dependent. Impact is execution under the user's full account authority: SSH keys, cloud credentials, everything in $HOME.

What to do

Match your defense to your actual runtime configuration:

• Agent on host, real $HOME, non-disposable workspace (what most developers run): only Continue in its default IDE mode structurally closes the bypass surface. It is the one correctly implemented guard of the eleven.
• Disposable workspace: a container sandbox is sound — but note some agents' sandbox "defends by default but fails under a documented and commonly used local-mode opt-out." Do not enable that opt-out.
• Do not rely on the model itself as the boundary; treat any guard that string-matches raw commands as confidence without protection, and keep human-in-the-loop on rather than trusting the guard to permit auto-mode.

The four failure modes, so you know what you're holding:

1. Guard exists and is defeated — Hermes, opencode (16/16 cases leaked), Goose (22/23).
2. Tokenized guard that leaks on quoted substitution and destructive flags (two agents).
3. No static guard at all.
4. Sandbox with a local/auto opt-out.

Cline is opt-in and config-dependent: 2/13 cases leak in allow+deny mode vs 8/13 in deny-only mode — prefer the allowlist configuration.

Caveats

Scoring denominators vary by test applicability, not rigor: 13–23 cases per agent depending on which of the five bypass classes apply to that guard. "Every agent fails" is imprecise — one of eleven (Continue) defends by design. The two VS Code-extension agents were tested via a headless harness importing production controller modules unmodified, not the shipped binary.