AI Model Vulnerabilities Exposed: Multi-Turn Attacks Pose Major Threat, Cisco AI Security Lead Reveals

The Importance of Multi-Turn Agent Security Testing

In a recent study conducted by Cisco, it was revealed that when 6,986 multi-turn attacks were carried out against 15 flagship models, attackers who adapted throughout the conversation were successful up to 88.3% of the time. This alarming finding was presented by Amy Chang, Cisco’s head of AI threat intelligence and security research, at the agentic security panel during VB Transform 2026. The statistics painted a concerning picture for those companies still relying on single-turn red-teaming programs.

The urgency of the matter was highlighted by VentureBeat’s June 2026 Pulse survey of 107 enterprise respondents, where over half (54%) reported experiencing a confirmed agent security incident (18%) or a near-miss caught before any harm was done (36%). Surprisingly, only 32% of the companies surveyed provided each agent with its own scoped, managed identity, and even fewer (30%) isolated their highest-risk agents in sandboxes. The majority (82%) still depended on provider-native and hyperscaler controls as the primary agent security layer.

To address the growing threats in the cybersecurity landscape, major security vendors like Palo Alto Networks, CrowdStrike, and Cisco have made significant acquisitions targeting the identity and isolation layer that many enterprises have yet to fully develop.

Amy Chang, with her extensive background in cybersecurity operations, government, and military, emphasized the importance of understanding how models are susceptible to different types of attacks. She stressed the need for multi-turn testing, which simulates real-world engagement with models, agents, and applications, uncovering harmful outputs and misaligned behaviors that single-turn testing fails to capture.

Chang’s approach to agentic deployments involves using Cisco’s Integrated AI Security and Safety Framework as a foundation to identify vulnerabilities across the AI lifecycle. By analyzing real incidents and tracing attack vectors, organizations can develop a robust strategy with the right coverage and mitigations in place.

Heather Ceylan, the CISO of Box, echoed the need for multi-turn adversary simulations to pressure test agents effectively. Box’s three-layer approach focuses on permissioning, ephemeral sandbox environments, and runtime execution control to prevent unauthorized actions.

Rajesh Parekh, VP of AI and ML at Intuit, advocated for a centralized platform, GenOS, which abstracts security, risk, and fraud modeling to ensure consistent protection across all agents. Parekh emphasized the importance of continuously testing and monitoring agents to address evolving threats and vulnerabilities.

The panel discussion underscored the critical need for organizations to adopt a proactive approach to agent security testing, moving beyond single-turn red teaming towards comprehensive multi-turn assessments. By incorporating deterministic controls, behavioral proxies, and continuously testing for vulnerabilities, companies can enhance their cybersecurity posture and protect against emerging threats in the ever-evolving digital landscape.