Multi-turn attacks broke AI models 88% of the time — single-turn testing missed it, Cisco AI security lead warns at VB Transform 2026

Summary

Multi-turn attacks successfully compromised AI models up to 88.3% of the time, according to Cisco's AI threat intelligence head, Amy Chang. This highlights the inadequacy of single-turn testing. Industry leaders from Box and Intuit discussed layered security approaches, identity management, and the shift towards agentic development cycles to address these evolving threats.

Key Takeaways

1. Multi-turn attacks compromised AI models up to 88.3% of the time, significantly outperforming single-turn testing in identifying vulnerabilities.
2. Enterprise adoption of robust agent security measures like scoped identities and sandboxing remains low, leaving them vulnerable to confirmed incidents or near-misses.
3. The security industry is responding with significant acquisitions focused on identity and isolation layers, indicating a strategic shift towards addressing agent security.

Statement Breakdown

• Claimed Facts: 60% of statements the article presents as facts
• Opinions: 30% of statements classified as editorial or subjective
• Claims: 10% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article presents findings from a Cisco study and quotes multiple industry experts, lending it significant credibility. It details methodologies and provides specific data points. However, the event context (VB Transform 2026) and the nature of AI security research suggest ongoing evolution, warranting careful interpretation.

Bias assessment: Security Vendor Advocacy. The article highlights security solutions and acquisitions by major vendors like Cisco, Palo Alto Networks, and CrowdStrike. While presenting factual data, the focus on vendor-led solutions and the framing of security challenges can subtly promote their offerings.

Note: This article offers valuable insights from AI security experts and industry trends. Consider the vendor-specific context and the evolving nature of AI security when evaluating the presented solutions.

Credibility flag: Expert Insights, Vendor Focus

Claimed Facts (8)

• This is a specific, quantifiable finding from a study presented as fact.
• This is a statistical finding from a survey presented as factual data.
• This provides specific percentages for enterprise security practices, presented as factual.
• These are reported financial transactions and strategic aims of companies, presented as factual events.
• This statement provides specific details about the methodology and scale of the study, presented as factual.
• This presents specific quantitative results from the study.
• This describes a specific implementation timeline and process at Box, presented as factual.
• This describes a specific product and its function within Intuit, presented as factual.

Opinions (10)

• This is a subjective interpretation and warning based on the presented data.
• This statement expresses a viewpoint on the importance of understanding model vulnerabilities.
• This is a subjective assessment of the complexity of security solutions.
• This is a subjective observation about the current state of AI red teaming practices.
• This is a prescriptive statement about the necessity of pressure testing agents.
• This expresses a strong belief in the importance of monitoring in AI security.
• This is a definitional statement that frames the concept of permissioning in a specific way.
• This describes a preferred operational model for AI systems.
• This is a strong, predictive opinion about the obsolescence of traditional security review methods.
• This expresses optimism about future AI capabilities while acknowledging current limitations.

Claims (10)

• This is a broad generalization about the internal calculations of multiple companies without specific evidence provided.
• While based on data, the word 'worry' introduces an emotional appeal and a subjective interpretation of the implications.
• The claim of 'simple' defensive answers can be subjective and may downplay the complexity of implementing them effectively.
• This statement is a subjective assessment that might oversimplify complex security challenges.
• This is a subjective statement that dismisses the need for creativity in security, which might be debatable.
• This is a definitive statement about the end of traditional methods, which might be an overstatement as these practices may still be relevant in some contexts.
• This is a subjective assessment of future timelines, lacking concrete metrics for 'a long way away'.
• While plausible, the direct equation of 'skills' to 'vulnerabilities' is a simplification that could be debated.
• The term 'dramatically' is an intensifier that adds a subjective and potentially exaggerated element to the claim.
• While good advice, the phrasing 'any sort of drift or any other types of dependencies' is broad and lacks specific examples, making it a general, less substantiated claim.

Key Sources

• Amy Chang — Cisco's head of AI threat intelligence and security research
• VentureBeat's June 2026 Pulse survey — Survey
• Palo Alto Networks — Security vendor
• CyberArk — Security vendor
• CrowdStrike — Security vendor
• SGNL — Security vendor
• Cisco — Security vendor
• Astrix Security — Security vendor
• Nicholas Conley — Co-author of Cisco study
• Heather Ceylan — CISO of Box
• Box — Technology company
• Rajesh Parekh — VP of AI and ML at Intuit
• Intuit — Financial software company
• Google — Technology company
• Middlebury Institute of International Studies — Educational institution
• JPMorgan Chase — Financial services company
• House Foreign Affairs Committee — Government committee
• U.S. Navy Reserve — Military branch