Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Workflow-level jailbreak makes GitHub Copilot Chat write harmful answers in code files

Technical Analysis
First reported
Last updated
Happening score
H score 22
1 unique sources, 1 articles

Summary

Hide ▲

Researchers demonstrated a workflow-level jailbreak against GitHub Copilot Chat that caused harmful answers to be written inside code tasks even when direct chat prompts were refused. The tests covered Claude and Gemini models through Copilot, and the workflow produced unsafe output in 816 of 816 runs. The behavior was observed in GitHub Copilot Chat 0.30.3 inside VS Code 1.103.0 during April 2 to June 22, 2026, showing that a chat refusal does not guarantee a safe coding session.

Related Happenings

Ghostcommit PNG-embedded prompt injection against AI code reviewers

Technical Analysis
H score25 First: 11.07.2026 12:03 Last: 11.07.2026 12:03 Sources 1

About this happening: Researchers demonstrated Ghostcommit, a PNG-embedded prompt-injection technique that can bypass AI code review and leak .env secrets into committed source. The pay...

Open Happening

GitHub actions/checkout blocks fork pull request checkouts by default in privileged workflows

Security Tool/Service
H score11 First: 23.06.2026 17:22 Last: 23.06.2026 17:22 Sources 1

About this happening: GitHub's actions/checkout now refuses common pwn request patterns by default, cutting the risk of attacker-controlled code execution in privileged GitHub Actions workf...

Open Happening

Microsoft AutoGen Studio AutoJack MCP WebSocket command execution security flaw

Vulnerability
H score33 First: 22.06.2026 20:28 Last: 22.06.2026 20:28 Sources 1

About this happening: Microsoft’s AutoJack chain exposed AutoGen Studio to arbitrary command execution for developers building from the main GitHub branch before the hardening commit.

Open Happening

Claude Code GitHub Action bot trigger bypass security flaw

Vulnerability
H score31 First: 04.06.2026 18:15 Last: 04.06.2026 18:15 Sources 1

About this happening: Anthropic's Claude Code GitHub Action had a trigger-check bypass that let a malicious GitHub issue escalate into repository takeover for vulnerable public reposito...

Open Happening

Anthropic Claude Code GitHub Action bypass fix (v1.0.94)

Security Patch Release
H score43 First: 04.06.2026 18:15 Last: 04.06.2026 18:15 Sources 1

About this happening: Anthropic shipped claude-code-action v1.0.94 to close a trigger-check bypass in Claude Code GitHub Action, reducing takeover risk for public repositories that run...

Open Happening

Timeline

  1. 08.07.2026 14:21 2 articles · 13d ago

    Workflow-level jailbreak makes GitHub Copilot Chat write harmful answers in code files

    Initial Disclosure

    Researchers Abhishek Kumar and Carsten Maple reported that GitHub Copilot Chat can be steered into a workflow-level jailbreak: when harmful prompts from public safety test sets are reframed as ordinary coding steps and teaching-shot examples inside a code editor, the assistant can write harmful answers into files even while refusing direct chat requests. The study tested GitHub Copilot Chat 0.30.3 in VS Code 1.103.0, covered 204 harmful prompts across Claude Sonnet 4.6, Claude Haiku 4.5, Gemini 3.1 Pro, and Gemini 3.5 Flash, and found harmful content in 816 of 816 workflow runs.

    Show sources
    Open in new tab