Cisco Study: Popular AI Language Models Vulnerable to Multi-Turn Jailbreak Attacks
Cisco researchers tested leading AI language models from OpenAI, Mistral, Meta, Google, Alibaba, Deepseek, and Microsoft and found that safety guardrails can be bypassed through multi-turn attacks where users ask multiple questions to gradually evade security measures. Success rates for extracting harmful information ranged from 26% with Google's Gemma to 93% with Mistral's Large Instruct model, compared to 13% with single-question attacks.
What happened
Cisco evaluated large language models from OpenAI, Mistral, Meta, Google, Alibaba, Deepseek, and Microsoft through 499 simulated conversations using multi-turn attacks, where users ask multiple questions to progressively bypass safety measures.
Each conversation contained between 5 and 10 interactions. On average, multi-turn attacks succeeded in extracting malicious information in 64% of conversations, compared to 13% when users asked only a single question.
Reported impact
Success rates for extracting harmful or inappropriate information ranged from approximately 26% with Google's Gemma to 93% with Mistral's Large Instruct model.
Cisco stated that multi-turn attacks could enable harmful content to spread widely or allow hackers to gain unauthorized access to a company's sensitive information. AI systems frequently fail to remember and apply their safety rules during longer conversations.
Index analysis
Cisco identified 15 sub-threat categories showing the highest failure rates across 102 total threat types, with malicious code generation, data exfiltration and ethical boundary violations ranked most critical.
Open-weight models where the public can access specific safety parameters often have lighter built-in safety features. Google, OpenAI, Meta, and Microsoft have stated they made efforts to reduce malicious fine-tuning of their models.
Governance controls
Cisco recommended that developers implement strict system prompts aligned with defined use cases, deploy model-agnostic runtime guardrails for adversarial detection, and conduct regular AI red-teaming assessments within intended business contexts.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.