At the VB Transform 2026 conference, Amy Chang, Head of AI Threat Intelligence at Cisco, announced a concerning discovery: multi-turn attacks can bypass the security guardrails of leading AI models with a success rate of up to 88.3%. This evaluation, conducted on 15 of today's most popular large language models (LLMs), demonstrates that traditional single-turn testing is missing a vast array of critical vulnerabilities when deploying AI into production.
Background & Root Causes
The trend of deploying automated workflows using AI agents is booming, but it comes with unprecedented security risks. According to a June 2026 survey by VentureBeat, up to 54% of surveyed enterprises admitted to experiencing or narrowly escaping a security incident related to AI agents. Notably, the majority of enterprises (82%) still rely entirely on default controls provided by model vendors rather than building specialized, in-house security layers. This lack of preparation has fueled a massive wave of mergers and acquisitions in the cybersecurity industry, highlighted by Palo Alto Networks' $25 billion acquisition of CyberArk and Cisco's $400 million acquisition of Astrix Security to reinforce identity management layers for AI.
Technical Analysis & Technology
Cisco's research was built on 30,090 single prompts and 6,986 coordinated multi-turn attacks against proprietary closed models. Unlike a 'one-and-done' single-turn attack—which relies on a single malicious prompt—a multi-turn attack mimics real-world hacker behavior by guiding the model through a prolonged conversation to gradually elicit malicious outputs or misaligned behaviors. To conduct this large-scale evaluation, Cisco developed an automated agentic testing framework. This framework allows attacking agents to assess the deployment environment, design their own attack scenarios, execute them, and self-grade their overall effectiveness.
Expert Insights & Perspectives
Heather Ceylan, Chief Information Security Officer (CISO) at Box, shared that testing AI with single prompts does not reflect how real users or attackers interact with AI on a daily basis. Box currently simulates multi-turn attacks by using adversary agents to continuously attempt to compromise their systems. However, Ceylan also warned of the risk of losing trust: 'They have to start from scratch' after a Box AI agent made a single mistake in the security operations center, despite previously building up substantial trust with human analysts. Meanwhile, Rajesh Parekh from Intuit proposed using a centralized Generative AI Operating System (GenOS) to automate fine-grained authorization for each specific agent task, rather than inheriting the user's full permissions.
Impact & Future Outlook
The shift from manual testing to fully automated, secure software development lifecycles for AI is an inevitable trend. Nonetheless, experts agree that enterprises must return to fundamental security principles, particularly the principle of least privilege access right from the initial configuration of AI systems. For technology professionals and engineers in Vietnam, the lesson from Cisco shows that AI safety evaluation cannot rely solely on static benchmarks or simple single-turn tests. Building dynamic testing scenarios, continuous monitoring, and establishing deterministic guardrails at runtime will be key to protecting AI agent systems against increasingly sophisticated attacks.