Alan Turing Institute researchers bypass AI model safeguards by disguising requests as work tasks

Researchers at the Alan Turing Institute have found a new way to get around AI model safeguards. Prohibited requests that a model refuses to answer directly can be disguised as routine tasks for an AI coding agent, and in that case the filters don't always catch them, according to a paper the researchers published.

How the bypass works

Modern AI models are trained to refuse clearly prohibited requests, such as those involving the creation of malicious code. But these safeguards are tuned primarily to recognize requests phrased directly in a chat. The researchers showed that if the same request is reworded as one item on a work task list for an AI coding agent, the model is more likely to carry it out without flagging it as prohibited.

• The vulnerability was discovered by researchers at the Alan Turing Institute
• The bypass method: disguising a prohibited request as a task for an AI coding agent
• The work was published as a standalone PDF document
• The issue affects models that normally refuse direct prohibited requests in chat mode

What is the Alan Turing Institute

The Alan Turing Institute is the UK's national institute for data science and artificial intelligence, headquartered in London. It regularly publishes research at the intersection of AI safety and real-world model deployment, including work on how attackers can get around the built-in restrictions of commercial chatbots and agentic systems.

Why this is dangerous for AI agents

Over the past couple of years, AI coding agents — tools that carry out chains of tasks on their own without constant human oversight — have gone mainstream. Developers now hand them entire to-do lists instead of individual one-off requests. That autonomy is exactly what opens the loophole: if a malicious task slips in unnoticed among legitimate items on the list, the agent may execute it in sequence along with the rest. Unlike in a regular chatbot conversation, the human won't see or review each step individually before it runs.

How the industry usually defends against these bypasses

Findings like this are called jailbreaks: methods of bypassing a model's built-in restrictions without technically hacking the system itself. Developers typically respond to a published vulnerability of this kind by fine-tuning the model on new attack examples and adding extra filters that check not just an individual request but the context of the entire conversation or task list. The problem is that each new layer of protection eventually prompts the next bypass, creating an ongoing arms race between model developers and security researchers.

What this means

The Turing Institute researchers' finding shows that safeguards built for ordinary chat conversations don't always carry over to agentic scenarios. As AI agents gain more and more autonomy in writing code, developers will have to test their safeguards not only against direct requests but also against requests disguised inside task lists.