Cisco says multi-turn AI attacks exposed gaps in model testing

Cisco told VB Transform 2026 that multi-turn AI attacks defeated leading proprietary models at rates as high as 88.3%, based on research across 15 flagship systems. Amy Chang, Cisco’s head of AI threat intelligence and security research, said the finding undercuts security programs that still test models mostly with one-off malicious prompts.

The Cisco study, co-authored by Chang and Nicholas Conley, used 30,090 single-turn prompts and 6,986 multi-turn attacks. The multi-turn success rate varied widely, from 7.89% to 88.3%, but Cisco said every model tested showed meaningful exposure. The two testing methods also produced different rankings of model risk, which means a model that looks comparatively safe in snapshot testing may perform worse when an attacker adapts over a conversation.

Chang said Cisco now publishes adversarial evaluation signals for 105 models through its LLM Security Leaderboard. Her point for enterprise buyers was direct: teams cannot assess agent risk if they do not understand how the underlying model fails under different attack styles.

Why do multi-turn AI attacks matter?

A multi-turn attack gives the adversary room to revise prompts, use prior answers, and move gradually toward a harmful outcome. That pattern is closer to how users interact with chatbots, agents and AI applications than a single hostile prompt, so it can reveal failures that ordinary red-team tests miss.

The warning comes as agent deployments are already producing security incidents inside enterprises. A June 2026 VentureBeat Pulse survey of 107 enterprise respondents found that 54% had either a confirmed AI agent security incident or a near miss. Only 32% said each agent gets its own scoped, managed identity, while 30% said they sandbox their highest-risk agents. Provider-native and hyperscaler controls remain the primary security layer at 82% of surveyed companies.

The vendor market is already moving toward that gap. Palo Alto Networks completed its $25 billion CyberArk acquisition in February, CrowdStrike agreed in January to acquire SGNL for $740 million, and Cisco announced plans to buy Astrix Security for a reported $400 million. Those deals all point at identity, authorization and isolation, the controls enterprises have not consistently built for agent fleets.

Box CISO Heather Ceylan told the panel that much agent red teaming still uses single-turn tests, even though that does not match daily AI use. Box now uses agents to simulate attackers that keep trying to hijack a target over multiple attempts. She said companies need to pressure-test agents to verify whether execution controls work as intended.

Box’s own controls are built around three layers: permissioning that limits an agent to the invoking user’s access, temporary sandbox environments for agent tasks, and runtime restrictions on tool calls. Ceylan said a document-summary agent, for example, should not be able to send a file to an attacker because that action should not be available to the agent.

Intuit has taken a more centralized approach. Rajesh Parekh, its vice president of AI and machine learning, said the company’s GenOS platform abstracts security, risk and fraud modeling so agent developers do not rebuild those protections on their own. Intuit moved from agents inheriting user permissions toward agents carrying their own identities, and Parekh said the company is studying permission changes during a session based on the task being performed.

Both Box and Intuit described ongoing monitoring as necessary because agent behavior can shift as models change. Ceylan said Box initially required human approval for every action by agents in its security operations center, then moved analysts into monitoring after trust grew. One mistake by the agent erased that trust, she said.

Chang’s recommended starting point was Cisco’s Integrated AI Security and Safety Framework, which maps ways AI systems can be compromised across the lifecycle, including modality and supply chain. Her practical advice was less exotic than the attack research: work backward from real incidents, test continuously, and keep permissions narrow.

This story draws on original reporting from VentureBeat.