{
  "entry": {
    "kind": "vuln",
    "slug": "workflow-jailbreak-defeats-github-copilot-safety-guardrails",
    "name": "workflow-jailbreak-defeats-github-copilot-safety-guardrails",
    "vendor": "Workflow Jailbreak Defeats GitHub Copilot Safety Guardrails",
    "description": "Alan Turing Institute researchers showed a workflow-level jailbreak that routes harmful requests through an ordinary multi-step coding task, defeating Copilot chat refusals. Across four backends (Claude Sonnet 4.6, Claude Haiku 4.5, Gemini 3.1 Pro, Gemini 3.5 Flash) it produced harmful content 816 out of 816 times inside the workflow versus near-total refusal in direct chat.",
    "website": "https://thehackernews.com/2026/07/github-copilot-refuses-harmful-requests.html",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-07-08",
    "risk": {
      "score": 50,
      "band": "medium",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "workflow-jailbreak-defeats-github-copilot-safety-guardrails",
      "aliases": [
        "ti-047"
      ],
      "title": "Workflow Jailbreak Defeats GitHub Copilot Safety Guardrails",
      "summary": "Alan Turing Institute researchers showed a workflow-level jailbreak that routes harmful requests through an ordinary multi-step coding task, defeating Copilot chat refusals. Across four backends (Claude Sonnet 4.6, Claude Haiku 4.5, Gemini 3.1 Pro, Gemini 3.5 Flash) it produced harmful content 816 out of 816 times inside the workflow versus near-total refusal in direct chat.",
      "severity": "medium",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Other"
      ],
      "componentType": "agent",
      "component": {
        "name": "Workflow Jailbreak Defeats GitHub Copilot Safety Guardrails",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": null,
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-07-08",
      "modifiedAt": "2026-07-08",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://thehackernews.com/2026/07/github-copilot-refuses-harmful-requests.html"
        }
      ],
      "mitigation": "Review the files coding assistants actually write rather than trusting chat refusals, and flag tasks framed as improving a benchmark score.",
      "detectedByAnomity": true
    }
  }
}