GitHub Copilot Guardrails Bypassed by Multi-Step Workflow Framing

GitHub Copilot IDE agents in VS Code, backed by Claude Sonnet 4.6, Claude Haiku 4.5, Gemini 3.1 Pro, and Gemini 3.5 Flash

Harmful requests that Copilot refuses in direct chat succeed when decomposed into ordinary coding-workflow steps. Across 204 harmful prompts and four model backends, direct prompting produced only 8 of 816 unsafe completions, while the workflow-staged version produced 816 of 816, with usable harmful output typically after about six exchanges

Safety guardrails evaluate a single prompt in isolation, so reframing a harmful goal as a sequence of benign-looking IDE tasks slips past them. Found by the Alan Turing Institute (Abhishek Kumar, Carsten Maple)