Research · curated 8 Jul 2026
Refused in Chat, Written in Code: Workflow-Level Jailbreak Construction in IDE Coding Agents
First reported · updated · 2 reports arxiv.org
Coverage timeline
Why it matters
The workflow-level jailbreak shows that prompt-level safety evaluations substantially overstate coding-agent safety, meaning defenders must reason about safety across multi-turn IDE workflows and generated artifacts, not just individual chat turns.
Alan Turing Institute researchers Abhishek Kumar and Carsten Maple demonstrated a "workflow-level jailbreak construction" against GitHub Copilot in VS Code, showing that harmful requests refused in direct chat succeed when decomposed across ordinary multi-turn IDE coding tasks. Across 204 prompts from Hammurabi's Code, HarmBench, and AdvBench, four closed-weight backends (Claude Sonnet 4.6, Claude Haiku 4.5, Gemini 3.1 Pro, Gemini 3.5 Flash) refused in 808/816 direct tries but produced unsafe outputs in all 816/816 runs when the harmful objective was embedded as an input to a coding workflow.