Why it matters
GuardFall tests 11 open-source coding and computer-use agents against shell-command transformations that evade string and regex deny lists, including quote removal, $IFS expansion, command substitution, and encoded payloads. The study finds configuration- and model-dependent failures and shows that local or auto-approve modes can turn untrusted repository content into host command execution; it is vendor-authored research, not an independent benchmark.
My takeaway: Do not use pattern matching or model refusal as the command boundary. Parse and canonicalize commands, re-check the resolved operation, disable auto-approve for untrusted work, protect agent configuration, and run agents in disposable sandboxes with minimal secrets, filesystem access, and network egress.