A 1989 Bash Quirk Just Broke AI Coding Agent Guardrails

Bash has been around since 1989. AI coding agents have been around for about fifteen minutes. Guess which one is winning.

Researchers at Adversa AI ran eleven popular open source agents, including Hermes, OpenCode and Roo-code, through a battery of old-school shell tricks. Ten of them could be coaxed into running destructive commands using techniques that predate most of the engineers shipping the agents.

What GuardFall actually is

Adversa has named the pattern GuardFall, and the mechanism is almost embarrassingly simple. The safety layer inside these agents tries to spot dangerous commands by scanning the raw text of what's about to run against a list of bad patterns. Bash, meanwhile, does what Bash has always done: it unwinds quotes, expands variables, rewrites arguments, and only then executes the result.

So the guard inspects one string. Bash runs a different one. The gap between those two strings is where the entire attack lives. Quote removal, $IFS as a space substitute, alternative argument shapes, all the dusty old obfuscation moves that have been sitting in shell tutorials for thirty-odd years. None of it is novel. All of it still works.

Why this is a supply chain problem

The scenario worth losing sleep over isn't a developer typing something silly into a prompt. It's the indirect one. An engineer points a coding agent at a repository. The agent dutifully reads the README, the Makefile, the config files, the issue threads. Some of that text contains instructions intended for the agent rather than the human, and those instructions ride straight through the approval gate disguised as ordinary content.

Because the agent runs with the developer's full account authority, the payoff is significant. AWS credentials lifted out of the home directory. SSH keys exfiltrated. An entire dev environment quietly wiped. In CI pipelines, where auto-yes is often the default and no human is watching, the attack has time to do whatever it likes.

The one agent that didn't fall over

Of the eleven agents Adversa tested, only Continue blocked every one of the canonical destructive cases. It did it by tokenising and canonicalising commands inside the agent itself, reasoning about what Bash would actually execute rather than pattern-matching the string it was handed.

For everyone else, Adversa's interim suggestions are the kind of advice you give when you can't fix the underlying thing:

• Run agents from a scoped shell with $HOME redirected to a sandbox directory.
• Turn off auto-yes.
• Audit any configs that ship inside a cloned repo before letting the agent loose on them.
• Don't run agents against fork pull requests.

Duct tape over a structural problem

None of those measures actually closes the hole. They just shrink the blast radius. The real issue is a mismatch between what the guard inspects and what the shell ultimately executes, and that mismatch doesn't go away until maintainers move the check inside the agent and teach it to read commands the way Bash does.

Until then, the working assumption has to be that anything an AI coding agent reads from an untrusted repository is, for practical purposes, something the developer has already agreed to run. Which is a strange thing to be true in 2025, given the trick that makes it true was already old when Taylor Swift was born.