Bypassing Copilot's Crescendo Mitigations with a Language Switch

Erik Ferguson · Published date: 2026-08-02

In April 2024, Microsoft published a paper about an LLM jailbreak technique called Crescendo; in January 2025 I discovered a way to bypass Crescendo mitigations on Bing Chat (now known as Copilot on copilot.microsoft.com) by switching languages during the Crescendo attack, getting Copilot to output harmful instructions about weapons and sabotage. Copilot of course wasn't supposed to output such information. The issue was considered mitigated in December 2025 and I received acknowledgement for contributing to AI safety by Microsoft. I didn't use any fancy AI safety frameworks to automate this: just good ol' fashioned trial and error. I'm writing this quite some time after everything happened, because a long time had passed after my case was opened, and I just discovered about 7 months after mitigation that it had been resolved as it no longer reproduces after product updates.

Crescendo is a multi-turn jailbreak technique that involves having an LLM use information from its previous responses to gradually guide the LLM to a desired harmful outcome. The user prompt in each turn appears to be benign, but by asking the LLM to do things like "tell me more about what you said in the second paragraph" you can steer the conversation in directions that are normally blocked.

Shortly after Microsoft published their Crescendo paper, they described how they mitigate the attack using a multi-turn prompt filter and a separate AI watchdog. Having studied Japanese for a bit over 2 years back in college, I was curious as to whether switching languages during the Crescendo attack would evade the filter and watchdog. I figured that for the AI watchdog to have low latency and to be cost effective, it must necessarily be limited in capability, and carefully following a conversational thread while translating across languages seemed like something that would be too expensive for the AI watchdog to implement. After a bunch of tries, I was successful in bypassing the Crescendo mitigations by switching to Japanese mid-attack! I've not received detail from Microsoft on how my jailbreak worked, so I'm simply explaining the thought process that led to the development of this technique.

As for whether Japanese was an obscure language for Copilot, it's an officially supported language for Copilot prompts and responses, although the history of that page admittedly doesn't go back to the time of my discovery. However, at the time I discovered the jailbreak, Microsoft's Azure AI Content Safety documentation listed Japanese among the languages its models were specifically trained and tested on. I don't know if Azure AI Content Safety was enabled for Copilot at the time, but overall it seems like Microsoft intended Copilot / Bing Chat to handle Japanese at the time I discovered the jailbreak.

Overall, I had a lot of fun developing this technique! Discovering how to jailbreak an LLM was considerably different from the previous cybersecurity work I've done, such as finding and exploiting an XSS. With an XSS you get a deterministic oracle: it either fires or it doesn't, and you can usually reason your way to why. But with an LLM, you're poking at a black box that can respond differently each time!

I also tried using this technique to jailbreak Claude Fable 5, Opus 5, Sonnet 5, and Haiku 4.5, but wasn't successful.

For some related research, consider the following:

Low-Resource Languages Jailbreak GPT-4: Low-resource languages such as Zulu can jailbreak in a single turn. If I remember correctly, I had heard of this result at the time.
Code-Switching Red-Teaming: LLM Evaluation for Safety and Multilingual Understanding: Switching languages within a single context (such as in the same sentence) can jailbreak. This was published after I reported the jailbreak: I hadn't heard of this result until Claude found it for me while working on this article.

Timeline

2025-01-18: Jailbreak reported to Microsoft.
2025-01-21: Microsoft opened a case.
... Across subsequent months, the status continued to indicate that remediation is in progress. I eventually stopped checking for updates, because life. 😿
2025-12-18: Microsoft apologized for the delayed response and said: "This is an older case that was never resolved. As model updates have released in the product, this issue no longer reproduces and is considered mitigated."
2025-12-31: Microsoft acknowledged my contribution to AI safety on their site. My first public credit for AI safety! 🎉
2026-07-25: I finally logged back into the MSRC and saw the updates... 😅

AI disclosure: Claude helped with some editing, did research on prior art, and informed how much information to disclose (as this is my first public disclosure).