Definition
GuardFall is a structural vulnerability class in AI coding agents where pattern-based shell guards approve commands as plain text, but Bash subsequently rewrites and executes obfuscated payloads via quote removal, $IFS spacing, and alternative argv shapes.
Mechanism
Agent guard inspects raw text → APPROVED
Bash expands/unquotes/rewrites → MALICIOUS COMMAND RUNS
Discovered by adversa-ai after NousResearch/hermes-agent regex denylist bypass. Survey of 11 popular open-source agents (May 2026): 10 vulnerable; only Continue implemented tokenize-and-canonicalize guards.
Attack Vectors
- Poisoned READMEs or Makefiles ingested by agents
- CI pipelines with auto-yes modes (
--auto-exec,--auto-run) - Fork PR workflows running agents against untrusted branches
Distinction from Other Threats
| Threat | Class | Vector |
|---|---|---|
| GuardFall | Shell guard architecture | Bash rewrite after approval |
| TrustFall | MCP folder trust | Malicious project MCP config |
| Mozilla 0DIN | Prompt injection chain | DNS TXT payloads |
| agentjacking | Telemetry injection | Fake Sentry errors |
Mitigations
- Disable auto-execute modes; require human approval
- Block agent runs on fork PRs
- Scope agent
$HOMEto isolated directory - Treat repo configs as untrusted code
- Structural fix: canonicalize before guard evaluation (Continue model)