Multi-turn attacks broke AI models 88% of the time — single-turn testing missed it, Cisco AI security lead warns at VB Transform 2026

Cisco's latest security research exposes a critical gap in how companies test AI model robustness. When researchers ran multi-turn attacks against 15 flagship AI models, attackers succeeded 88.3% of the time by adapting their approach across multiple conversation turns. Single-turn testing, the current industry standard for red-teaming, completely missed these vulnerabilities.

Amy Chang, Cisco's head of AI threat intelligence and security research, presented the findings at VB Transform 2026, signaling a major blind spot in enterprise AI security. The research involved 6,986 distinct multi-turn attacks, demonstrating that adversaries don't need a single perfect prompt. They exploit the conversational nature of AI systems by adjusting their strategy based on model responses, gradually manipulating the system toward unintended behavior.

This matters because most security teams rely on one-shot red-teaming exercises. A model passes a single adversarial prompt test and gets cleared for deployment. But that testing framework ignores how real attackers operate. In production, bad actors engage with models iteratively, learning what works and what doesn't within the same conversation thread.

The implications extend beyond theoretical security. A companion VentureBeat survey of 107 enterprises found that over half had already experienced an AI agent security incident. Many companies remain unprepared for agentic AI systems that operate with elevated privileges and extended conversation contexts.

The 88.3% success rate represents a systemic failure in current validation practices. It reveals that flagship models, the ones enterprises trust with sensitive operations, carry exploitable weaknesses that only surface under realistic attack patterns.

Organizations need to overhaul their testing regimen immediately. Single-turn red-teaming provides false confidence. Multi-turn adversarial testing, where attackers simulate real-world persistence and adaptation, should become standard practice before any AI system touches production worklo