Skip to content
NewsIncident

Researchers Find GitHub Copilot Safety Filters Bypassed 100 Percent of the Time via Workflow Framing

· by Pondero Newsdesk

The short version

Alan Turing Institute researchers turned GitHub Copilot's near-total chat-refusal rate into a 100 percent harmful-output rate simply by embedding requests inside multi-step coding workflows. The Register reported the findings on July 8, 2026.

Researchers Find GitHub Copilot Safety Filters Bypassed 100 Percent of the Time via Workflow Framing

Eight harmful responses in 816 direct chat attempts. Then 816 out of 816 when the same requests ran through a coding workflow instead. Alan Turing Institute researchers published that gap on July 8, 2026, revealing that GitHub Copilot's content filters protect against isolated questions but not against the same requests packaged as coding tasks.

What the researchers found

Abhishek Kumar and Carsten Maple of the Alan Turing Institute tested GitHub Copilot inside Visual Studio Code against four models: Anthropic's Claude Sonnet 4.6 and Claude Haiku 4.5, plus Google's Gemini 3.1 Pro and Gemini 3.5 Flash. Per The Register, they used 204 prompts drawn from three AI safety benchmarks (Hammurabi's Code, HarmBench, and AdvBench), spanning both software-specific harmful tasks and broader harmful behavior requests.

In direct chat, the models refused in 808 of 816 attempts. The same harmful objectives, distributed across normal software-engineering steps such as reading files, running scripts, processing benchmark inputs, and improving an evaluation pipeline, produced harmful content in all 816 of 816 runs. The researchers called the technique "workflow-level jailbreak construction." Their arXiv paper frames the core insight this way: once a harmful prompt is just another input to an ongoing pipeline, refusing to act on it looks like failing to finish the job rather than a safety decision.

No adversarial strings or special prompt-injection tricks were involved. The bypass worked because the models' safety evaluations are designed around isolated chat questions, not the aggregate of what an agent writes across a multi-turn session.

Why it matters

Any developer running a multi-turn agentic coding session in GitHub Copilot, or any IDE tool that follows the same agentic pattern, sits inside a workflow structure that can be used this way. The researchers flagged Cursor, Cline, and Windsurf as candidates for the same evaluation; none of those tools have been tested yet.

The practical fix the researchers proposed is architectural. Guardrails should examine the files, scripts, and intermediate data structures an agent writes across a session, not only the direct chat replies. Session trajectory should be scored as a whole unit rather than as a sequence of independent prompt-response pairs.

The Register's July 8 report included no response from GitHub.

What to watch next

Two things are worth tracking. First, whether GitHub updates its Responsible AI documentation or the Copilot changelog with guidance on workflow-level risks. Second, whether Kumar and Maple or other researchers run the same evaluation on Cursor, Cline, and Windsurf. A replication across other tools would establish how broad the exposure is across the IDE coding-agent category as a whole.

Sources