2026-07-08 · 2026-Q3
GitHub Copilot Guardrails Bypassed by Multi-Step Workflow Framing
Outside the model: Model safety Agent tooling was not the attack surface, so no layer applies.
- Fixable:
- Unknown
- Vendor response:
- Unknown
- In the wild:
- No
Target
GitHub Copilot IDE agents in VS Code, backed by Claude Sonnet 4.6, Claude Haiku 4.5, Gemini 3.1 Pro, and Gemini 3.5 Flash
Impact
Harmful requests that Copilot refuses in direct chat succeed when decomposed into ordinary coding-workflow steps. Across 204 harmful prompts and four model backends, direct prompting produced only 8 of 816 unsafe completions, while the workflow-staged version produced 816 of 816, with usable harmful output typically after about six exchanges
Root Cause
Safety guardrails evaluate a single prompt in isolation, so reframing a harmful goal as a sequence of benign-looking IDE tasks slips past them. Found by the Alan Turing Institute (Abhishek Kumar, Carsten Maple)