Executive brief
Continue is an open-source AI coding agent that can autonomously execute terminal commands when running in unattended mode. The application uses an incomplete blocklist to prevent destructive shell commands like forced removal and data-wiping utilities. An attacker can inject malicious commands through web pages, code repositories, or issue descriptions that the agent reads, causing the autonomous agent to execute commands that destroy the user's files and data.
Technical details
The vulnerability is a security control bypass in terminal command filtering. The Continue CLI's permission system relies on a denylist in isCriticalCommand() that blocks only a limited set of dangerous paths (/, /*, ~, ~/*, /usr, /etc, /bin, /sbin) and does not disable destructive commands targeting /home, /root, /var, /opt, or /srv. Additionally, the denylist fails to block shred, wipefs, truncate, pkexec, and find with -delete. Shell variable expansion (e.g., $HOME) is not properly handled during command parsing, allowing bypass of path-based filters. The attack vector is indirect prompt injection: when the headless agent autonomously reads untrusted content (web pages, repository files, issue text) without user interaction, an attacker can embed shell commands that the agent will execute with the invoking user's privileges, leading to unauthorized data destruction.
Affected products
- Continue Continue CLI
Timeline
- 2026-08-24: disclosed