June 2026 — Adversa AI researchers disclosed GuardFall, a structural security flaw affecting 10 of 11 popular open-source AI coding agents tested, including Hermes, OpenCode, and Roo-code. Only Continue blocked all tested bypass cases.
GuardFall exploits a mismatch between pattern-based shell guards (which inspect raw command text) and Bash shell execution (which strips quotes, expands $IFS, and rewrites argv before running). Decades-old shell obfuscation tricks bypass denylist regex filters after the guard approves the command.
Because agents run with developer full account authority, poisoned READMEs or Makefiles can trigger credential exfiltration or environment destruction — especially in CI pipelines with auto-yes modes.
Mitigations recommended:
- Run agents from scoped shells (redirect $HOME to temporary directory)
- Disable auto-execute modes (—auto-exec, —auto-run)
- Block agent execution on untrusted fork pull requests
- Treat repo-shipped configuration files as untrusted code
Long-term fix requires tokenize-and-canonicalize guards that anticipate Bash rewriting, as Continue implemented — not brittle string-based filters.
Research triggered by NousResearch/hermes-agent approval gate bypass via shell rewrites against a 30-pattern regex denylist.