GuardFall shell bypass
When: Jun 30, 2026 (Adversa AI research)
Surface: 10 of 11 open-source coding / computer-use agents (opencode, Goose, Cline, Aider, OpenHands, SWE-agent, and others)
Class: Shell-quoting / expansion bypass of pattern-based command guards
Adversa AI showed that guards inspecting the raw command string miss payloads that Bash later expands ($IFS, quote removal, command substitution). A poisoned README, MCP server, or Makefile can then drive destructive commands with the operator’s privileges. Documented in awesome-ai-agent-attacks and The Hacker News / SC Media.
Without Relay
- Teams relied on client-side denylists inside the agent product—same class of string matching GuardFall beats.
- Once bypassed,
rm, credential theft, and cloud CLIs ran as the user with no second org control plane. - No Behavior Guard counted the destructive outcome class independently of the obfuscated spelling.
How Relay could have safeguarded
Be honest about limits: Relay bash rules also match with contains on the command text. That is necessary but not sufficient against clever obfuscation. Defense in depth:
| Layer | What to configure | Effect on this path |
|---|---|---|
| Bash control | Prefer allowlists for day-to-day work (npm test, git status) over only denying rm -rf | Unknown obfuscated strings never get a default allow |
| Enforcement | Soft / Enforce on anything outside the allowlist | Human gate when the agent invents a weird one-liner |
| Path control | Deny reads of .ssh, .aws, .env regardless of which shell spelling is used | Exfil via cat/type variants still hits path deny when the Read/path hook fires |
| Destructive Burst | Count delete / destructive substrings / sensitive writes | Burst of wipe attempts escalates even if one spelling slipped through |
| Prompt control | Flag “ignore safety” / exfil instructions from README-injected context | Reduces successful injection before shell is proposed |
| Audit | Review allows for novel shell shapes after incidents | Tighten allowlist from real Live wire traffic |
Retro checklist
- Move from “deny bad strings” to allow known good for production seats.
- Never rely on a single agent vendor’s local guard as the org control plane.
- Enable Destructive Burst + path denies on secrets as the backstop.
- After a GuardFall-style drill, paste failed bypass attempts into Rulebook samples and re-test.
Related: Bash · Path · Destructive Burst · Case studies overview