Alan Turing Institute bypassed AI safety protections by disguising requests as coding tasks

Alan Turing Institute bypassed AI model safeguards by disguising requests as work tasks

Researchers from the Alan Turing Institute discovered a new way to bypass AI model safety mechanisms: banned requests that the model normally refuses to answer can be disguised as ordinary tasks for an AI agent that helps write programming code — in which case the filters do not always work, according to the work they published.

What the bypass consists of

Modern AI models are trained to refuse answers to obviously prohibited requests — for example, those related to creating malicious code. But these safety mechanisms are primarily designed to recognize direct request formulations given directly in the chat. Researchers showed that if such a request is reframed as one of the items on a task list for an AI agent that helps with programming, the model is more likely to execute it without recognizing it as prohibited.

• Vulnerability discovered by researchers from the Alan Turing Institute
• Bypass method — disguising a prohibited request as a task for an AI programming agent
• Work published as a separate PDF document
• Problem affects models that normally refuse direct prohibited requests in dialog mode

What is the Alan Turing Institute

The Alan Turing Institute is a British national research center for data and artificial intelligence with headquarters in London. It regularly publishes research at the intersection of AI safety and practical application of models, including works on how attackers can bypass built-in restrictions of commercial chatbots and agent systems.

Why this is dangerous for AI agents

Over the past couple of years, AI programming agents — tools that independently execute chains of tasks without constant human oversight — have become a mass phenomenon: developers assign them entire to-do lists instead of individual one-off requests. It is precisely this autonomy that creates the loophole: if a malicious task slips unnoticed among legitimate items on the list, the agent can execute it one by one along with the others, and a human, unlike in normal dialogue with a chatbot, will not see or evaluate each step separately before execution.

How the industry usually defends against such bypasses

Such findings are called jailbreaks — methods of circumventing a model's built-in restrictions without technically hacking the system. Normally, developers respond to publication of such a vulnerability by retraining the model on new examples of attacks and adding additional filters that check not only the individual request but also the context of the entire dialogue or task list as a whole. The problem is that each new layer of protection over time provokes the appearance of the next bypass — it's a constant race between model developers and security researchers.

What this means

The Turing Institute's findings show that safety mechanisms refined for ordinary chat dialogue do not always transfer to agent scenarios: as AI agents gain more autonomy in writing code, developers will need to test protection not only on direct requests but also on requests disguised within task lists.