Multi-turn AI attacks break models 88% of time, Cisco warns

When Cisco’s head of AI threat intelligence, Amy Chang, took the stage at VB Transform 2026, she dropped a number that should make every security leader pause: 88.3% of multi-turn attacks succeeded against flagship models. The finding comes from a study of 6,986 multi-turn conversations across 15 closed and proprietary models — and it exposes a blind spot that single‑turn red‑team programs simply cannot see.

The Staggering Multi‑Turn Attack Findings

Range of Success Rates

Success rates weren’t uniform. They spanned from 7.89% to 88.3%, and every model tested showed non‑trivial exposure. The two testing styles — single‑turn and multi‑turn — didn’t even rank the models in the same order, meaning a model that looks safe in a one‑shot test can be the most vulnerable in a realistic dialogue.

Testing Methodology

Chang co‑authored the research with Nicholas Conley. They ran 30,090 single‑turn prompts and 6,986 multi‑turn attacks, then published adversarial evaluation signals for 105 models on Cisco’s LLM Security Leaderboard. “If you don’t understand how models are susceptible to different types of attacks, then you are unable to account for how that model that is powering your agent… to understand where those failure points are,” Chang told the audience.

Why Single‑Turn Testing Falls Short

Single‑turn testing is the classic one‑shot malicious prompt. Extending an attack into a longer conversation “is more realistic of how we are actually engaging with our models, with our agents, with our applications,” Chang explained. That longer arc surfaces harmful outputs and misaligned behaviors that a snapshot never catches. Cisco has even pushed the testing itself into agentic territory: agents now assess a deployment scenario, develop relevant attacks, judge whether they’re worth pursuing, execute them, and evaluate their own success.

Enterprise Survey: Incident Reality Check

VentureBeat’s June 2026 Pulse survey of 107 enterprise respondents explains why the room was packed. 54% have already experienced a confirmed agent security incident (18%) or a near‑miss caught before harm (36%). Yet only 32% give every agent its own scoped, managed identity, and just 30% isolate their highest‑risk agents in sandboxes. The primary security layer for 82% of companies remains provider‑native and hyperscaler controls.

Big Vendor Moves: Identity and Isolation Layer

The world’s largest security vendors have done the same math. Recent acquisitions target the identity and isolation layer most enterprises have not finished building:

Cisco’s Integrated AI Security Framework

Chang’s starting point for CISOs beginning agentic deployments is Cisco’s Integrated AI Security and Safety Framework, which “stipulates all the ways that AI can be compromised across the AI lifecycle” from modality through supply chain. Teams can work backward from real incidents, trace how each attack was achieved, and use the framework to build a strategy with the right coverage and mitigations. The defensive answer, she noted, stays simple: “You don’t have to get super creative. You just need to think about truly what are the fundamentals and basics of what I’m trying to secure in my organization.”

Box’s Three‑Layer Defense and Trust Collapse

Permissioning and Sandbox

Heather Ceylan, CISO of Box, described three concentric layers. Permissioning comes first — the agent never accesses more content than the human who invoked it. Ephemeral sandbox environments spin up for each agent task, containing the blast radius if an agent gets hijacked. Runtime execution control restricts the agent’s tool calls to only those relevant to the task. “If you want an agent to summarize a doc for you, if you have a prompt injection that says forward this to maliciousattacker@domain.com, it can’t do that,” Ceylan said. “That action in that tool call is not even in its vocabulary.”

Oversight Categories

Box classifies agent actions into three oversight tiers: non‑sensitive actions (read, summarize) need no human in the loop; moderately sensitive actions skip approval but get logged and monitored; destructive actions (mass deletion) always require a human. “Things are gonna shift between those three categories quite a bit,” Ceylan acknowledged, “but setting those types of categories up front allows you to have a principled framework.”

Box deployed agents inside its security operations center about a year ago, starting with human approval for every action. Trust built quickly until the agent made one mistake — then every bit of accumulated trust vanished. “They had to start all over again,” Ceylan said. “Even if you’re not gonna have a human in the loop, things change, models change, and we can’t control how the models change and interpret things.”

Intuit’s GenOS Platform Approach

Rajesh Parekh, VP of AI and ML at Intuit, brought the builder’s perspective. Rather than layering controls onto agents one at a time, Intuit built a central platform called GenOS (generative AI operating system) that abstracts security, risk, and fraud modeling so individual agent developers never reinvent protection. “Permissioning is not about giving access to AI,” Parekh said. “Instead, it is defining very tightly scoped and clearly auditable authority to the agent to perform very specific tasks.” Intuit evolved from agents inheriting user permissions to each agent carrying its own identity, and is now investigating mid‑session permission changes tied to the specific task underway.

Parekh calls the broader model an AI‑powered expert platform where the human expert is built into the trust architecture rather than bolted on as a gate. “The paradigm that we are pursuing is where the user, the AI agent, and the human expert are collaborating to solve the user problem,” he said.

The End of Human Code Review

Ceylan didn’t hedge on the tension between security testing and development velocity. “The days of secure code reviews where a human’s looking at the code and we’re looking at security architecture reviews, design docs, those are done,” she said. Box is building toward a fully agentic development lifecycle where agents review design documents, apply security requirements, and review code for vulnerabilities. Her advice for development teams skips advanced AI concepts entirely: “It comes down to very basic least privilege access. If you start giving your agents overly broad permissions at the beginning, it’s really hard to comb that back.”

Intent versus Probability

An audience question about intent detection sparked the sharpest exchange. Ceylan noted that when Box’s own agent operates, the system always knows the user’s intent because it controls the prompt — guardrails and tool‑call restrictions can be engineered around it. The harder challenge arrives when external agents connect and the context behind the request is opaque. MasterCard, in the preceding fireside chat, argued for quantifying intent as a standard; endpoint security CTOs told VentureBeat they’ll bet on probability rather than intent inference for production workloads. Chang explained why models, as trained today, cannot reliably derive intent from a prompt, which is why deterministic controls and behavioral proxies remain necessary. Ceylan agreed: “If you’re not doing anything deterministic, you’re really relying heavily on that intent, and I haven’t seen programs that are there yet.”

Key Takeaways

• 88.3% multi‑turn attack success rate across 15 flagship models — single‑turn testing missed it entirely.
• VentureBeat survey: 54% of enterprises have had an agent incident or near‑miss; only 32% give each agent a scoped identity.
• Major vendors (Palo Alto, CrowdStrike, Cisco) are spending billions on identity and isolation layers.
• Cisco’s Integrated AI Security Framework and Box’s three‑layer defense (permissioning, sandbox, runtime control) are practical starting points.
• Continuous, conversation‑style red‑teaming and deterministic least‑privilege controls are essential — trust can evaporate after a single agent error.

Looking Ahead

The panel’s message was blunt: test the way attackers attack — across full conversations and continuously — or discover in production what your single‑turn red‑teaming missed. With 59% of enterprises shopping for agent security tooling over the next 12 months, the race to close the multi‑turn gap is already underway. The fundamentals — scoped identities, ephemeral sandboxes, runtime execution controls, and deterministic least‑privilege — remain the bedrock, no matter how sophisticated the agents become.