Ten of Eleven AI Coding Agents Fell to a Shell Trick Older Than the People Who Wrote Them. The One That Held Is Named Continue.

The oldest trick in the Unix book just beat the newest tools in the industry, and it beat almost all of them at once. A team at Adversa AI took eleven open-source AI coding agents — the autonomous assistants that read your repo, decide what to do, and run shell commands to do it — and tried a bag of shell-quoting tricks that were already old when most of these projects' authors were in grade school. Ten of the eleven fell. One held. Its name is Continue, and it held because it was built by someone who assumed the shell would betray it.

We are late to this one — Adversa disclosed it in June, and it did not surface in our own coverage until this week's sweep, which is exactly the kind of gap we would rather name than paper over. But it belongs in our arc, because it is the systematic, measured proof of the single failure that every AI-agent security story this year keeps circling back to.

The failure is a gap between reading and doing

Here is the whole vulnerability in one sentence: the agent inspects the command as text, and the shell executes it as something else.

An AI coding agent has a safety filter. Before it runs a command, it looks at the string — "does this contain rm -rf, does this touch /etc, does this curl something and pipe it to bash" — and if the string looks clean, it runs it. The problem is that the string it inspected is not the program that runs. Bash takes that string and rewrites it: it expands variables, it substitutes the output of subcommands, it splits tokens on whitespace, it strips and reinterprets quotes. By the time bash is done, a command that read as harmless to the filter has become something destructive. The filter graded the script. The shell ran the rewrite.

The tricks that exploit this gap are not new research. They are the standard shell-injection evasions that penetration testers have used for thirty years — splitting a forbidden word across quotes so r""m reads as clean but runs as rm, hiding a command inside $(...) substitution, using $IFS to smuggle whitespace past a filter that keys on spaces, base64-encoding a pipeline and decoding it at runtime. Adversa named the class GuardFall, and by their count it landed on ten of eleven agents they tested: Cline, Goose, Aider, OpenHands, Roo-Code, SWE-agent, Open Interpreter, Plandex, opencode, and Hermes. They estimate it reaches more than half a million open-source deployments. The only one of the eleven that did not fall was Continue.

Why Continue held, and why that is the whole point

Continue held because it did not try to be smarter than bash at reading bash. The losing design is the intuitive one: look at the command, decide if it is dangerous, allow or block. It fails because "look at the command" and "decide if it is dangerous" both happen against a string that the shell has not finished interpreting yet. You cannot filter a language by inspecting its source if a second interpreter gets to rewrite the source before it runs. The only defenses that work are the ones that stop trusting the text — running without a shell at all, passing arguments as a structured list instead of a command line, or sandboxing the execution so that a filter bypass does not become a filesystem wipe.

This is the same lesson, wearing a different hat, that we have written three times in the last two months. The Claude browser-extension isTrusted bug was an agent trusting a click event's text instead of checking whether a human made it. GhostCommit hid the payload in an image an AI reviewer read as a picture and never as instructions. GuardFall is an agent trusting a command's text instead of what the shell will make of it. Every one of them is the same shape: the agent is fooled by the gap between what it perceives and what actually executes, and the tell — the thing worth reporting flat — is which agent's designers assumed that gap exists and built for it. Continue did. Ten others did not.

GuardFall does not travel alone

The uncomfortable part is that GuardFall is one finding in a cluster of shell-channel failures that dropped around the same time, and the cluster reaches past open source into the tools most people actually run. Alongside it came a Claude Code deny-rule bypass, a command-injection RCE in the Antigravity agent, an RCE chain in the CrewAI framework, and TrustFall — a folder-trust dialog that, once clicked, leads to unsandboxed execution of MCP servers at startup, affecting Claude Code, Cursor, Gemini CLI, and GitHub Copilot CLI. The through-line is that the agent's shell and its permission boundary are the softest surface it has, precisely because that is where the agent has to touch the real machine to be useful. An agent that cannot run commands is a chatbot. An agent that can run commands is a shell-injection target wearing a language model.

What to actually do

If you run any of the affected open-source agents, update to the version that carries the fix, and check the changelog for the words "argument list," "no shell," or "sandbox" rather than "improved filter" — a better blocklist is a better version of the thing that already failed, and a real fix stops parsing the command and starts constraining the execution. If you point an AI coding agent at a repository you did not write, treat that as running untrusted code on your machine, because that is what it is: the repo can carry a README, an issue, or a build file whose text steers the agent into a command the agent's filter will wave through. And do not run these agents with credentials and network access they do not need for the task in front of them, because GuardFall turns a filter bypass into whatever the agent's permissions allow, and a scoped-down agent bounds the blast.

We hold this at 95 percent. The count of ten-of-eleven, the affected list, and the half-million figure are Adversa AI's testing, not ours, and a survey of eleven agents is a survey, not the whole field. What we are confident about is the direction, because we have now watched the same failure arrive from a browser event, an image file, and a shell string in eleven weeks: the guardrail keeps grading the thing the agent reads, and the damage keeps coming from the thing the machine runs. The agent that survives is the one whose builders never trusted the text in the first place.

---

How do AI models see YOUR brand?

AIPM has audited 250+ domains. 15 seconds. Free while still in beta.

Audit your site now → aipmsec.com