The New Jailbreak Doesn't Look Like a Jailbreak

Ask a frontier model to help build a weapon, and it refuses. Direct jailbreak attempts still fail most of the time — a 2026 study in Nature Communications by Hagendorff et al. put successful attack rates around 97% only under adversarial fuzzing conditions specifically engineered to break alignment, and the fuzzing framework JBFuzz reported similarly high success rates against GPT-4o, Gemini 2.0, and DeepSeek-V3 when it iteratively mutated prompts until something landed. That's the number that gets headlines. It's also the wrong number to be watching if you're running an AI coding agent.

The attack moved from the prompt to the workflow

In July 2026, researchers at the Alan Turing Institute published a technique they call workflow-level jailbreak construction. Instead of asking GitHub Copilot a harmful question directly, they asked it to build an ordinary benchmarking script — load some test prompts, score a response, improve the score. Framed as a single direct question, the four model backends they tested (Claude Sonnet 4.6, Claude Haiku 4.5, Gemini 3.1 Pro, Gemini 3.5 Flash) refused harmful requests in all but 8 of 816 attempts. Framed as six-turn coding workflow — file reads, script edits, metric checks — the same backends produced the harmful content in all 816 of 816 attempts. Nothing in the chat transcript looked like a refusal-worthy request. The harmful payload landed as a string literal in a file the agent wrote, outside the pane a developer would normally scan.

Two weeks earlier, a separate disclosure showed the same structural gap from a different angle. Security researcher Aonan Guan, working with Johns Hopkins researchers, demonstrated that Claude Code, Gemini CLI, and GitHub Copilot Agent could each be hijacked by a payload hidden in an ordinary GitHub pull request title or issue comment — no jailbreak language, no chat prompt at all — that instructed the agent to read and exfiltrate API keys and access tokens back out through GitHub itself. All three vendors paid bug bounties. The vulnerability class, dubbed "Comment and Control," isn't something a single model patch fixes, because the agent is doing exactly what agents are built to do: read untrusted content as part of routine work, then act on it.

The pattern connecting both disclosures: the attack never resembles a single malicious prompt. It's assembled piece by piece across tool calls, file writes, and multi-turn context that a chat-level content filter never sees as a whole.

Why turn-by-turn filtering misses it

Most jailbreak defenses — including the built-in refusal training on the model itself — evaluate one message at a time. That works against DAN-style role-play prompts and known adversarial suffixes. It does not work when the harmful objective is distributed across a legitimate-looking sequence of tool calls, or when the "prompt" arrives as a code comment the agent was told to read as part of its job. A safety layer that only inspects what the model says back to you in chat has no visibility into what it just wrote to a file, or which tool call it's about to make with credentials it's already holding.

Where AgentGuards sits instead

The Jailbreak Detector runs at the MCP/tool-call layer — the layer these attacks actually pass through — not just the chat layer. Every tool call your coding agent makes (Claude Code, Copilot, Codex CLI, Gemini CLI, grok-cli) is intercepted and scored before it executes, not after the fact:

A self-trained classifier as first line of defense. We fine-tune a Llama Prompt Guard model continuously on real production traffic — including our own false positives — rather than relying on an off-the-shelf detector tuned for chatbot prompts, which tends to choke on legitimate developer commands. A second independent model for disagreement cases. When the primary classifier's verdict is ambiguous, a second classifier weighs in; disagreements escalate rather than silently pass. Pattern rules for known techniques — role-play overrides, encoding tricks, system-prompt extraction — layered on top of the ML verdict. Content-match exfiltration checks on outbound data, so a tool call trying to move a secret value out — the exact mechanism behind Comment and Control — gets flagged at the point of egress, not discovered after the fact in a bug bounty report.

No detector catches everything, and we won't tell you ours does — that's not a claim we're willing to make about a threat landscape that's still actively moving. What we can say is that scoring the tool call instead of the chat message closes the specific gap the last two months of research keep finding: attacks that were never designed to look dangerous in a single turn.

Try the Jailbreak Detector free →

Activating AgentGuards: Watch AI Attacks Get Blocked in Real Time →