Single-turn red teaming gives defenders a false sense of safety. Evaluating an enterprise AI model with isolated, one-shot prompts misses how real attackers behave. At VB Transform 2026, security executives from Cisco, Box, and Intuit made it clear: when adversaries interact iteratively across a conversation, existing safety guardrails collapse far more often than static evaluations suggest.
Testing a snapshot of an AI model's behavior only reveals how it responds to a single provocation. In actual operations, attackers adapt, rephrase, and build context over multiple interactions to bypass system prompts and policy filters.
The Snapshot Mirage in Enterprise AI Defense
The gap between single-turn evaluation and multi-turn attack reality is wide. VentureBeat's June 2026 Pulse survey of 107 enterprise security leaders revealed that 54% have already suffered a confirmed agent security incident (18%) or caught a near-miss before damage occurred (36%). Despite this high incident rate, 82% of enterprises still rely on provider-native or hyperscaler controls as their primary defense layer.
Only 32% of surveyed organizations assign a dedicated, managed identity to every deployed AI agent, and just 30% isolate high-risk agents within sandboxed environments. Meanwhile, 59% of security teams report shopping for specialized agent security tooling over the next year.
This disconnect has triggered massive enterprise security M&A activity. Palo Alto Networks acquired CyberArk for $25 billion in February 2026, CrowdStrike agreed to acquire SGNL for $740 million in January, and Cisco announced its intent to acquire Astrix Security for a reported $400 million. Major vendors are racing to plug the identity and isolation gaps that enterprise deployments left exposed.
How Adaptive Multi-Turn Attacks Break Guardrails
Amy Chang, Cisco's head of AI threat intelligence and security research, presented research demonstrating why single-turn testing falls short. Co-authoring a study with Nicholas Conley, Chang evaluated 15 closed and proprietary flagship models using 30,090 single-turn prompts alongside 6,986 multi-turn attacks, as detailed in VentureBeat's coverage of the research.
The results showed that attackers who adapt over a multi-turn conversation succeeded between 7.89% and 88.3% of the time depending on the model. Every single model tested exhibited non-trivial exposure under multi-turn pressure. Single-turn and multi-turn evaluations produced completely different security rankings across the 15 models. A model that appeared resistant against isolated prompts often collapsed when exposed to conversational manipulation, moving operational risk beyond system prompts.
Chang, who brings two decades of experience spanning cybersecurity operations at JPMorgan Chase, service as a U.S. Navy Reserve officer, and policy work on the House Foreign Affairs Committee, emphasized that multi-turn interaction matches actual usage. Cisco tracks these evaluation signals across 105 models on its public LLM Security Leaderboard.
To test defenses at scale, Cisco developed an agentic red-teaming framework where testing agents assess scenarios, craft attack strategies, execute multi-turn attempts, and measure their own success. Despite that testing complexity, Chang noted that the core defense boils down to basic security hygiene, starting with Cisco's Integrated AI Security and Safety Framework to map risks across the AI lifecycle and trace incident pathing.
Practical Sandboxing and Layered Oversight at Box
Heather Ceylan, CISO at Box, echoed the necessity of moving beyond single-turn testing. Box runs multi-turn adversarial simulations using specialized red-teaming agents that iterate through attack strategies to stress-test execution controls.
Ceylan shared a lesson from Box's deployment of AI agents inside its security operations center roughly a year ago. Box initially required human approval for every agent action. As the agent operated reliably, analysts built trust and transitioned into a passive monitoring role. However, when the agent made a single unexpected error, that accumulated trust vanished overnight, forcing the team to reset its operational baseline.
To prevent agent failures from impacting production systems, Box enforces three concentric security layers:
- Tight permissioning: An agent never receives more data access than the human user who invoked it.
- Ephemeral sandboxing: Task-specific sandbox environments spin up dynamically to isolate execution and cap the potential blast radius.
- Execution tool restricting: Tool calls are strictly limited to the specific task. If an attacker injects a prompt telling a summarization agent to exfiltrate data to an external email address, the agent cannot execute the request because the email tool call does not exist in its vocabulary.
Box categorizes agent actions into three distinct oversight tiers:
- Non-sensitive actions (like document summarization) run autonomously without human intervention.
- Moderately sensitive actions execute without pre-approval but generate detailed audit logs for monitoring.
- Destructive actions (such as file deletion) strictly require explicit human authorization before execution.
Standardizing Defense with Intuit's GenOS Architecture
Rajesh Parekh, VP of AI and ML at Intuit and former computer vision lead at Google, detailed how Intuit addresses agentic security architecturally through its GenOS platform.
Rather than expecting individual engineering teams to construct custom guardrails, GenOS centralizes and abstracts security, risk, and fraud modeling, helping organizations address how legacy stacks break multi-agent autonomy. Intuit shifted away from agents inheriting broad user permissions toward assigning distinct identities to individual agents, while actively researching mid-session permission adjustments scoped to specific in-flight tasks.
Parekh describes this setup as an AI-powered expert platform, where the user, the AI agent, and a human expert collaborate within a shared trust boundary. When Intuit uncovers new vulnerability patterns during manual red-teaming exercises, those vectors are automatically codified back into the GenOS testing harness. This ensures that all future agents inherit immediate protection against known attack paths while human red teamers focus on novel threats.
Deterministic Guardrails versus the Fallacy of Intent Inference
A key debate at VB Transform 2026 focused on whether enterprise security systems can accurately infer an AI agent's intent. Ceylan noted that while Box can control and infer intent for internal prompts, evaluating requests from external, third-party agents remains problematic due to opaque context.
This distinction highlights a broader industry divide. Organizations like Mastercard advocate for open-source frameworks to standardize intent propagation across enterprise procurement networks. Conversely, many endpoint security leaders favor probabilistic models and deterministic enforcement.
Chang pointed out that current AI models cannot reliably deduce intent from text prompts alone. As a result, security architectures must rely on hard, deterministic controls and runtime monitoring rather than assuming a model will correctly interpret context under attack.
Relying solely on single-turn red teaming or native model guardrails creates dangerous blind spots. As multi-turn attacks prove, securing autonomous AI agents requires strict least privilege, dynamic sandboxing, automated regression testing, and unyielding execution constraints.
