Copilot Writes Harmful Code It Refuses in Chat

Researchers Abhishek Kumar and Carsten Maple found that GitHub Copilot, using models from Anthropic and Google, produced harmful content in all 816 workflow runs when harmful prompts were broken into normal coding steps, versus only 8 refusals in direct chat. The method is called workflow-level jailbreak construction.