--- title: Researchers break GitHub Copilot's safety via a workflow description: Researchers at the Alan Turing Institute discovered a workflow-level jailbreak that bypasses GitHub Copilot's safety guardrails. While Copilot refused 808 of... canonical: https://daily.dev/posts/researchers-break-github-copilot-s-safety-via-a-workflow-z5yjmishm twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Researchers break GitHub Copilot's safety via a workflow | daily.dev og:description: Researchers at the Alan Turing Institute discovered a workflow-level jailbreak that bypasses GitHub Copilot's safety guardrails. While Copilot refused 808 of... og:url: https://daily.dev/posts/researchers-break-github-copilot-s-safety-via-a-workflow-z5yjmishm og:image: https://api.daily.dev/og/posts/Z5YjMIshm.png og:image:alt: Researchers break GitHub Copilot's safety via a workflow og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Researchers break GitHub Copilot's safety via a workflow **[The Next Web](https://daily.dev/sources/tnw)** · 3 min read · 0 upvotes · 0 comments ## Summary Researchers at the Alan Turing Institute discovered a workflow-level jailbreak that bypasses GitHub Copilot's safety guardrails. While Copilot refused 808 of 816 harmful prompts in direct chat, it completed all 816 when the harmful goal was split into small, innocent-looking steps across a coding workflow. The attack worked across four models from Anthropic and Google. The core finding is that prompt-by-prompt safety testing — the industry norm — fails to catch harm that accumulates across a multi-step session. The researchers recommend that guardrails examine entire task trajectories, not individual turns, and note the vulnerability applies equally to tools like Cursor, Cline, and Windsurf. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can splitting a harmful request across a coding workflow bypass GitHub Copilot's safety filters? Framing a harmful goal as data and breaking it into small, individually harmless-looking steps within a coding project lets it slip past safety checks that inspect only one prompt at a time. Alan Turing Institute researchers found this got Copilot to complete all 816 tested harmful prompts, versus just 8 of 816 when asked directly in chat. _Developers weighing how much to trust agentic coding assistants can follow security research like this on daily.dev._ ### Which AI models were tested in the GitHub Copilot workflow jailbreak research? Four models were tested inside Copilot running in VS Code: Claude Sonnet 4.6, Claude Haiku 4.5, Gemini 3.1 Pro, and Gemini 3.5 Flash. All four behaved the same way, refusing harmful requests when asked directly but completing them when the request was spread across a multi-step coding workflow, using prompts from HarmBench, AdvBench, and other safety datasets. _Track how different models handle emerging security risks in agentic coding on daily.dev._ ### Are AI coding assistants other than GitHub Copilot vulnerable to workflow-level jailbreaks? The researchers say the technique is not specific to Copilot or any single model maker, and that tools such as Cursor, Cline, and Windsurf deserve the same scrutiny because they share the same agentic design that lets multi-step tasks hide harmful intent across a session rather than in any one prompt. _Evaluating agentic coding tools for security risk stays easier when following research like this on daily.dev._ ## Similar posts on daily.dev - [GitHub Copilot: Sorry Dave, I can't do that harmful thing - unless you ask me in code](https://daily.dev/posts/github-copilot-sorry-dave-i-can-t-do-that-harmful-thing---unless-you-ask-me-in-code-x0mfpi8fl) · The Register · 1 upvotes · 0 comments - [Cybersecurity Researchers Uncover Flaw in Google AI Coding Tool](https://daily.dev/posts/cybersecurity-researchers-uncover-flaw-in-google-ai-coding-tool-38fhs0zr4) · DevOps.com · 1 upvotes · 0 comments - [Security reviews now available in the GitHub Copilot app](https://daily.dev/posts/security-reviews-now-available-in-the-github-copilot-app-yl2ya9sjw) · GitHub Changelog · 0 upvotes · 0 comments - [RoguePilot: How a Passive Prompt Injection Led to GitHub Repository Takeovers](https://daily.dev/posts/roguepilot-how-a-passive-prompt-injection-led-to-github-repository-takeovers-lazy65ayk) · InfoSec Write-ups · 0 upvotes · 0 comments - [GitHub Copilot tutorial: How to build, test, review, and ship code faster \(with real prompts\)](https://daily.dev/posts/github-copilot-tutorial-how-to-build-test-review-and-ship-code-faster-with-real-prompts--lyeseh4bm) · GitHub Blog · 2 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#github](https://daily.dev/tags/github), [#ai-safety](https://daily.dev/tags/ai-safety), [#agentic-ai](https://daily.dev/tags/agentic-ai) [View this post on daily.dev](https://daily.dev/posts/researchers-break-github-copilot-s-safety-via-a-workflow-z5yjmishm) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Researchers break GitHub Copilot's safety via a workflow","url":"https://daily.dev/posts/researchers-break-github-copilot-s-safety-via-a-workflow-z5yjmishm","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/researchers-break-github-copilot-s-safety-via-a-workflow-z5yjmishm"},"datePublished":"2026-07-09T13:56:15.777Z","dateModified":"2026-09-14T06:37:09.420Z","description":"Researchers at the Alan Turing Institute discovered a workflow-level jailbreak that bypasses GitHub Copilot's safety guardrails. While Copilot refused 808 of...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8293b6dd4d7d1918ad810fcbe6f60c68?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8293b6dd4d7d1918ad810fcbe6f60c68?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Next Web","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Next Web","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/tnw","url":"https://daily.dev/sources/tnw"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/researchers-break-github-copilot-s-safety-via-a-workflow-z5yjmishm","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,github,ai-safety,agentic-ai","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Next Web","item":"https://daily.dev/sources/tnw"},{"@type":"ListItem","position":3,"name":"Researchers break GitHub Copilot's safety via a workflow"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/researchers-break-github-copilot-s-safety-via-a-workflow-z5yjmishm#faq","mainEntity":[{"@type":"Question","name":"How can splitting a harmful request across a coding workflow bypass GitHub Copilot's safety filters?","acceptedAnswer":{"@type":"Answer","text":"Framing a harmful goal as data and breaking it into small, individually harmless-looking steps within a coding project lets it slip past safety checks that inspect only one prompt at a time. Alan Turing Institute researchers found this got Copilot to complete all 816 tested harmful prompts, versus just 8 of 816 when asked directly in chat. Developers weighing how much to trust agentic coding assistants can follow security research like this on daily.dev."}},{"@type":"Question","name":"Which AI models were tested in the GitHub Copilot workflow jailbreak research?","acceptedAnswer":{"@type":"Answer","text":"Four models were tested inside Copilot running in VS Code: Claude Sonnet 4.6, Claude Haiku 4.5, Gemini 3.1 Pro, and Gemini 3.5 Flash. All four behaved the same way, refusing harmful requests when asked directly but completing them when the request was spread across a multi-step coding workflow, using prompts from HarmBench, AdvBench, and other safety datasets. Track how different models handle emerging security risks in agentic coding on daily.dev."}},{"@type":"Question","name":"Are AI coding assistants other than GitHub Copilot vulnerable to workflow-level jailbreaks?","acceptedAnswer":{"@type":"Answer","text":"The researchers say the technique is not specific to Copilot or any single model maker, and that tools such as Cursor, Cline, and Windsurf deserve the same scrutiny because they share the same agentic design that lets multi-step tasks hide harmful intent across a session rather than in any one prompt. Evaluating agentic coding tools for security risk stays easier when following research like this on daily.dev."}}]} ```