A recent survey by Adversa AI has revealed a significant security vulnerability called GuardFall affecting 10 of the 11 popular open-source AI agents, which allows attackers to bypass command filters via shell injection. The flaw arises from a mismatch between how commands are filtered and how they are executed in Bash. The agents tested include Hermes, opencode, and others, with 'Continue' being the only one that effectively mitigates these issues through a robust command validation strategy.
The report highlights multiple bypass methods and emphasizes the need for improved security conventions in AI coding agents to prevent potential exploitation and unauthorized command execution.