Coding agents' shell filters check the text, not what bash runs, so injected commands sail past
Ourtake
The guard read the sentence. Bash read the command. Only one of them had your SSH keys in scope.
What happened
Researchers found that pattern-based shell guards in ten open-source AI coding agents can be bypassed with decades-old shell tricks, letting prompt-injected commands run. Live tests using Claude Sonnet 4.6 ran destructive commands on the host, mostly with auto-execute on. Only Continue's guard held.