Workflow-Level Prompt Injection Bypasses Safeguards, Gets Copilot to Write Malware

AI-assisted development tools have become standard equipment for software engineers, but their security defenses are coming under strain. The Alan Turing Institute recently found that conventional defenses filter prompts only within individual conversations. When malicious instructions are broken down into seemingly harmless steps in a routine development workflow, AI assistants struggle to detect them and can even be exploited to generate malware. The findings suggest future cybersecurity defenses must monitor the entire integrated development environment.

In research published in July 2026, the Alan Turing Institute demonstrated a technique it called “workflow-level jailbreak construction.” The team tested models including GitHub Copilot, Claude and Gemini. Conventional conversations produced only 8 successful guardrail bypasses, but all 816 workflow-attack tests breached the defenses—a 100% success rate—and generated malicious code.