Security firm Adversa AI has found a structural flaw — dubbed GuardFall — affecting 10 of 11 popular open source AI coding agents, including Hermes, OpenCode and Roo-code. Lead researcher Omer Ben Simon showed that attackers can embed old-school Bash tricks like quote removal and $IFS spacing into content agents ingest, such as a poisoned README or Makefile.
Once inside, those commands can silently steal AWS credentials or wipe dev environments, running with the developer's full account authority. The worst case is a CI pipeline with auto-execute switched on, where nobody is watching the terminal at all.
Only one agent, Continue, successfully blocked all test bypasses. Adversa recommends maintainers adopt a tokenize-and-canonicalize evaluator guard — the approach Continue uses — rather than relying on pattern-based text matching that Bash simply rewrites around. No fixes have been announced yet, so if your agents run unattended in CI, turning off auto-execute is the short-term answer.
Source: SecurityWeek