Shell Quoting Beats Command Guards in 10 of 11 Agents

A shell injection technique bypasses the command guards in 10 of 11 open-source coding agents, per Adversa AI's July roundup, which names it GuardFall. That matters because most teams find out about agent vulnerabilities through a CVE feed or a dependency scanner. No CVE was assigned to GuardFall, so it won't show up in either.

The guards work by scanning a command string against a regex or a denylist before executing it. Quoting breaks that check almost every time. The tricks are decades-old shell syntax, older than the agent guards that failed against them.

Quoting rewrites the string without changing what the shell actually runs. The roundup also flags compositional attacks. Chaining several individually-allowed commands together produces something the guard never evaluates as a unit, which makes per-command scanning obsolete on its own terms.

Adversa's recommended fix is enforcement at the OS layer: seccomp, Landlock, gVisor, or a microVM. That way the kernel decides what's allowed to run, not a wrapper script guessing at the model's syntax.