Beyond the One-Shot: How Multi-Turn Attacks are Rewriting AI Security
If you think your current AI security testing regime is holding up, think again. According to insights shared at VB Transform 2026, the industry is largely looking at the problem backward.
Cisco's Amy Chang brought a number to the panel that should make any CISO break a sweat: multi-turn attacks on flagship AI models have a success rate as high as 88.3%. Let that sink in. Most enterprises are still relying on single-turn red-teaming—the digital equivalent of testing a fortress door once, finding it locked, and assuming the entire perimeter is secured.
The reality is far more subtle, and far more dangerous. Attackers aren't just sending a single malicious prompt; they are engaging, iterating, and adapting over the course of a conversation. By the time they have pushed the model through several turns, their success rate skyrockets, completely bypassing the single-shot defenses that most firms rely on.
The Failure of Snapshots
Single-turn testing is essentially a snapshot in time. It measures a model against a static malicious input. But when you’re deploying autonomous agents that persist over time, that snapshot lacks context. It doesn't capture the evolution of an adversary's tactics as they feel out the model's guardrails, testing where it buckles and where it holds.
Chang's research, which tested 15 proprietary models against nearly 7,000 multi-turn attacks, showed that these two testing styles—single-turn and multi-turn—don't even rank models in the same order. A model that looks rock-solid under a one-shot attack might be a sieve under a persistent, conversational adversary.
For those building with agents, the takeaway is stark: if you don’t understand how your model behaves over the long arc of a conversation, you’re flying blind. You aren’t just testing a prompt; you’re managing an interaction.
Pressure-Testing the Agent
Heather Ceylan, CISO at Box, sees this mismatch daily. The industry, she notes, is still stuck in a mindset where red teaming is a discrete, point-in-time check. That doesn't reflect how people—or attackers—actually interact with these systems day-to-day.
Box’s approach to the problem is more proactive. They are now simulating these multi-turn adversaries using agents designed to think like attackers, iterating relentlessly until they find a breach point. It’s an arms race where the defender moves at the speed of the model.
But it’s not just about testing. It’s about execution control. Ceylan describes Box’s strategy as three nested layers of defense. First, you need strict permissioning so an agent can’t access data the user couldn’t reach. Second, put that agent in an ephemeral sandbox to contain the blast radius if things go sideways. Finally, runtime execution control is crucial—restrict the agent's capabilities so that even if it's convinced to do something malicious, it doesn't have the tools to actually execute that command.
If an agent's vocabulary of action doesn't include the command, it can't execute it. Simple, effective, and indispensable.
The Shift to Identity-Based Security
If Ceylan is focused on containing the agent, Rajesh Parekh, VP of AI and ML at Intuit, is focused on defining its authority from the ground up. Intuit’s approach to agentic security culminated in GenOS, their generative AI operating system.
The old way of doing things—agents inheriting user permissions—is becoming a liability. It’s too blunt an instrument. Instead, Intuit is treating each agent as its own distinct identity with clearly scoped, auditable authority. It’s a shift from permission-based access to task-scoped authority, ensuring that the agents do exactly what they need to do for the specific task at hand, and nothing else.
What Parekh advocates is a paradigm shift in how we think about the "human-in-the-loop." Instead of a human being a gatekeeper who signs off on every action—a bottleneck that kills velocity—he argues for human expertise to be built into the trust architecture. The AI agent, the human expert, and the platform collaborate. It’s about creating a system where security is embedded in the workflow, not bolted on afterward.
Moving Beyond the Manual
The tensions between security and development velocity are real, but Ceylan is clear: the conventional model of security is dying. "The days of secure code reviews where a human's looking at the code and we're looking at security architecture reviews... those are done," Ceylan said.
This is the hard truth of the new agentic landscape. If you are still relying on human-led architectural reviews to secure agentic systems, you are going to get left behind. We need automated, continuous monitoring and dynamic security frameworks that can adapt to changing model behaviors.
Cisco’s Integrated AI Security and Safety Framework offers a starting point, but the execution requires a fundamental change in how we think about risk. We have to map out every way an AI system can be compromised across the lifecycle—from the data it's trained on to the tools it uses—and work backward from there.
The security of the coming wave of autonomous agents isn't waiting in a manual, somewhere on a shelf. It’s being forged in the middle of these conversations, in the iterative pressure-testing of our models, and in the platforms that enforce their authority.
It’s a massive challenge, and it’s finally getting the attention it deserves. But let’s not kid ourselves—the attackers are already in the middle of the next turn. Are you ready?
This report is based on insights presented at VB Transform 2026.
