Cisco Study Reveals Major AI Models Vulnerable to Multi-Turn Adversarial Attacks
A Cisco AI Threat Research study of 15 proprietary frontier large language models from OpenAI, Anthropic, Google, Amazon, and xAI found that adversarial attack success rates increased sharply when attackers could iterate across multiple conversation turns. Multi-turn attack success rates ranged from 7.9% to 88.3%, compared to single-turn rates of 2.2% to 64.9%, with models showing different rankings in the two testing regimes.
What happened
Cisco AI Threat Research tested 15 proprietary frontier large language models from OpenAI, Anthropic, Google, Amazon, and xAI, measuring adversarial attack success rates across single-turn and multi-turn scenarios using 30,090 single-turn prompts and 6,986 multi-turn attacks distributed across 1,456 conversations.
Multi-turn attack success rates ranged from 7.9% to 88.3% across the cohort, compared to single-turn rates of 2.2% to 64.9% on the same models. xAI's Grok 4.1 Fast in non-reasoning configuration showed the widest gap, moving from 34.2% single-turn to 88.3% multi-turn, while Anthropic's Claude Opus 4.5 showed a narrower gap from 2.19% to 11.2%.
The study found that the two testing regimes produced different model rankings and that models appearing strong in single-turn benchmarks did not necessarily perform as well under multi-turn attacks. Cisco noted that enabling reasoning mode on Grok 4.1 Fast reduced the multi-turn attack success rate from 88.3% to 43.5%, a configuration effect not captured in public benchmarks or model cards.
Reported impact
The research suggests that single-turn safety benchmarks used in model cards and procurement reviews may give organizations an incomplete view of frontier AI risk and cannot be treated as a reliable proxy for adversarial robustness.
Every model tested showed non-trivial multi-turn attack success rates when adversaries could iterate, reframe refusals, adopt personas, decompose tasks, and escalate gradually across conversations.
Index analysis
The study employed 30,090 single-turn prompts and 6,986 multi-turn attacks under the Cisco Integrated AI Security and Safety Framework taxonomy. Attack strategies covered role-play and persona adoption, contextual ambiguity, refusal reframing, information decomposition and reassembly, and crescendo-style incremental escalation.
Governance controls
Cisco called on model providers to document the safety effects of configuration flags such as reasoning modes and system-prompt adherence settings in their official documentation.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.