10 of 11 AI coding agents fell to the same shell trick

vladimirrotariu — Wed, 19 Aug 2026 14:58:57 +0000

Adversa AI disclosed GuardFall on 30 June 2026. Their bypasses got past the command filter in 10 of 11 open-source coding and computer-use agents. One held, Continue, and it held because it parses the command before judging it, rather than matching patterns in raw text.

The trick is decades old. The guard inspects the string the model produced, and bash rewrites that string before running it. A regex reads r''m and finds nothing to match, then bash strips the quotes and runs rm. $IFS expansion and command substitution do the same. Two parsers read the same bytes and disagree, and the second one runs as root.

Tightening the allowlist leaves that open, because the gap is the string itself.

Typed actions instead

I build SysKnife, a Linux sysadmin co-pilot that runs as an MCP server and accepts typed actions only. The tool surface carries no exec and no sudo-exec, so nothing on it takes text from the model and hands it to a shell. AptInstall { package: "ripgrep" } is a schema-checked value, and I compiled the daemon that carries it out against a fixed catalogue of 190 typed actions it cannot extend at runtime. An action outside that catalogue has no representation to reject.

Three properties follow from that.

The agent cannot approve its own work. sysknife_plan returns typed steps with risk levels and a transaction id, then stops. Execution needs a receipt that only sysknife approve <transaction-id> mints, typed by a human at a real terminal, valid once and for fifteen minutes. The daemon checks that receipt where the privilege sits, so an agent that talks itself into having permission gets refused anyway. There is no phrasing of "yes, go ahead" inside a chat window that substitutes for it.

A deterministic reproduction of the Claude Code MCP flow, rendered offline by mcp-flow-mock.sh so it replays identically from a fresh checkout. Live LLM calls are nondeterministic and the tape renders with no daemon or provider configured, so the recording is scripted rather than captured. The same flow works in Cursor and Codex CLI.

Privilege stays behind a boundary the model cannot reach. The MCP server runs unprivileged. Every mutation travels to sysknife-daemon over a unix socket at mode 0660, inside a directory at 0750 sysknife:sysknife, and the daemon holds the sudoers and polkit policy. It reads the caller's identity from SO_PEERCRED, so the kernel names who connected and the request body never gets to claim it.

The daemon signs what it executes, and you can check the signature without the daemon. Rows join an Ed25519 hash chain that verifies against the exported public key alone, with no signing key and no access to the host that wrote the log. A row names the account that asked for it: uid:1000, or token:vsock when the caller presented a shared secret, or none:unattributed when the daemon could not establish an account. Signing an honest "I could not tell" beats signing a uid the kernel never vouched for.

Two commands

npx sysknife-setup --codex
sysknife audit verify --pubkey audit-key.pub

The first appends an MCP block to ~/.codex/config.toml and writes an AGENTS.md, then downloads binaries it checks against a published SHA-256 sums file. The second is the one an auditor runs, and it needs nothing but the public key.

Codex is one of three targets. --claude merges .mcp.json and writes a rules file under .claude/, which is the setup the recording above shows. --cursor writes .cursor/mcp.json and its own rules file. --all does the three together, and the installer with no flag asks you which you want. The daemon and the approval boundary are identical underneath: the agent surface changes, the privilege boundary does not.

Support, stated by evidence

Ubuntu 20.04 and later are eligible, LTS and interim alike. Three of them, 22.04, 24.04 and 26.04, each passed the full story suite 79 of 79 on a live VM, each with a committed replay twin that reproduces the run offline. The support matrix lists the evidence release by release, so a release the suite has never run on says so. Fedora Atomic 41 and later is implemented and eligible, and waiting on a current VM run. MIT licence, and the code sends no telemetry.

One caveat about directory listings, including the ones that carry a green badge for this project. Boot the server inside a build container and all five MCP tools show up, because a tool list is static metadata and no privileged daemon exists in a sandbox. A green run there proves the binary starts and the schemas parse, and stops short of proving it administers a real host. For that part you have the VM runs, release by release, and a signed chain you can check for yourself.

Your terminal can't render LaTeX. Here's a 10-second fix for Claude Code and Codex

vladimirrotariu — Sat, 18 Jul 2026 01:36:22 +0000

Ask Claude Code or Codex to explain some math and your terminal shows this:

H(p) = $-\sum_{i} p_{i} \log p_{i}$

That is LaTeX. A browser renders it into a clean equation. A terminal renders it into dollar-sign noise, because a TUI has no math engine to run. The more math-heavy your work (ML, statistics, optimization, proofs), the worse the output gets exactly where you need it clear.

The fix is not "render the LaTeX"

That is the hard, unsolved path: it needs a graphics backend like Kitty or SIXEL, plus a fallback for SSH and tmux. There is a cheaper move. The model does not have to output LaTeX at all.

Unicode already has most inline math: ∑, ∫, √, ≤, ≥, ∈, α, β, σ, x², pᵢ, set notation, even small matrices. A terminal renders all of it, because it is just text. So you teach the model to skip LaTeX and emit the Unicode directly:

before: H(p) = $-\sum_{i} p_{i} \log p_{i}$
after: H(p) = − ∑ᵢ pᵢ · log pᵢ

claude-math

claude-math does exactly that. It has no runtime; it is a SKILL.md the agent loads, with a glyph cheatsheet so the mapping stays consistent. It is copy- and search-safe (plain Unicode, not the "mathematical alphanumeric" styling codepoints that break find-in-page), and the same file works in Claude Code and Codex.

npx claude-math install # Claude Code
npx claude-math install --codex # Codex CLI

Restart your agent and math comes back as text you can read.

One caveat, stated plainly: this is a workaround, not native rendering. A dense derivation is still clearer as typeset math, and on a GUI surface that already renders LaTeX you want the LaTeX, not Unicode. claude-math is deliberately a terminal tool. Buh that fills an agent's answers, it is an immediate improvement.

Repo: https://github.com/vladimirrott/claude-math

If the Unicode mapping ever looks wrong, that is exactly the kind of issue I want to hear about.