Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-07-21 · high
The trick predates every agent involved, and no CVE was filed, meaning standard vulnerability scans won't catch it.
Why now: It surfaced in Adversa AI's July roundup rather than a numbered advisory, the kind of coverage a CVE-only tracking process would miss.
A shell injection technique bypasses the command guards in 10 of 11 open-source coding agents, per Adversa AI's July roundup, which names it GuardFall. That matters because most teams find out about agent vulnerabilities through a CVE feed or a dependency scanner. No CVE was assigned to GuardFall, so it won't show up in either.
The guards work by scanning a command string against a regex or a denylist before executing it. Quoting breaks that check almost every time. The tricks are decades-old shell syntax, older than the agent guards that failed against them.
Quoting rewrites the string without changing what the shell actually runs. The roundup also flags compositional attacks. Chaining several individually-allowed commands together produces something the guard never evaluates as a unit, which makes per-command scanning obsolete on its own terms.
Adversa's recommended fix is enforcement at the OS layer: seccomp, Landlock, gVisor, or a microVM. That way the kernel decides what's allowed to run, not a wrapper script guessing at the model's syntax.
Each link below shares sources, entities, or timing with this story.
Claude Code uses Landlock / Shared entities / Same source
Linked by a graph relationship (Claude Code uses Landlock); both cover GuardFall, Landlock, No CVE; cite the same source (Adversa AI's July roundup).
Claude Code uses Landlock / Shared entity: Adversa AI / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code uses Landlock); both cover Adversa AI; reported by the same outlet (adversa.ai).
Adversa AI criticizes Cursor / Shared entity: Adversa AI / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Adversa AI criticizes Cursor); both cover Adversa AI; reported by the same outlet (adversa.ai).
Claude Code uses Landlock / Shared entity: Adversa AI / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code uses Landlock); both cover Adversa AI; reported by the same outlet (adversa.ai).
Claude Code uses Landlock / Shared entities / Earlier coverage
Linked by a graph relationship (Claude Code uses Landlock); both cover July, Landlock; earlier July coverage from 2026-07-16.
Claude Code uses Landlock / Shared entity: July / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code uses Landlock); both cover July; overlapping topics (agent, attack).
Linked by a graph relationship (Claude Code uses Landlock); both cover July; overlapping topics (agent, away).
Linked by a graph relationship (Claude Code uses Landlock); both cover July; overlapping topics (agent, command).