The AI security arms race has entered a new, more dangerous phase — and most enterprise defences aren't keeping up. While CISOs have spent years hardening perimeters against ransomware and phishing, a quieter, more insidious threat has been maturing inside their own AI deployments. Multi-turn AI attacks — sophisticated, conversation-spanning jailbreaks that slowly erode a model's safety guardrails — are now breaking through flagship AI models at alarming rates. If your organisation has deployed any large language model (LLM)-powered application, chatbot, or AI agent, this threat applies directly to you.

Here's what you need to know, and — more importantly — what you need to do about it.

What Are Multi-Turn AI Attacks?

Traditional AI security threats were relatively straightforward: a malicious actor submits a single, cleverly worded prompt hoping to trick a model into producing harmful output. Security teams could screen for these with input filters, keyword blockers, and content classifiers. Multi-turn attacks are fundamentally different.

Multi-turn jailbreaking attacks bypass AI security measures by gradually steering conversations toward harmful outputs through innocent-seeming steps — a threat that standard single-message testing misses entirely.

The most well-documented example is Crescendo, a technique that has become a benchmark for understanding this class of threat.

Crescendo is a multi-turn jailbreaking technique that uses benign inputs to compromise a target model, exploiting the LLM's tendency to follow patterns and pay attention to recent text — especially text the model itself has already generated. It begins with an abstract, innocuous question and then gradually steers the model to generate harmful content in small, seemingly benign steps.

The critical danger here is stealth.

Single-turn safety filters score each message in isolation, so a request that would be refused outright can often be elicited indirectly — the attacker first establishes a conversational context that makes the harmful request look like a natural continuation, and only then closes the loop.

The Numbers That Should Alarm Every CISO

This isn't a theoretical concern. The empirical data is stark.

When Cisco ran 6,986 multi-turn attacks against 15 flagship models, attackers who adapted across the conversation broke through as often as 88.3% of the time.

To put that in context,

the safety benchmarks used across the industry miss almost all of this behaviour, and the gap between published safety scores and observed resilience runs wide enough to misrank leading models.

The models tested weren't obscure or poorly-maintained —

the report paired single-turn and multi-turn evaluation across 15 closed flagship models from OpenAI, Anthropic, Google, Amazon, and xAI.

No vendor is immune.

And the enterprise impact is already being felt.

More than half of enterprise respondents in a VentureBeat survey — 54% — have already had a confirmed agent security incident (18%) or a near-miss caught before harm (36%).

Meanwhile,

Pillar Security's State of Attacks on GenAI report found 20% of jailbreaks succeed in an average of 42 seconds, with 90% of successful attacks leaking sensitive data.

Why Enterprise AI Is Uniquely Vulnerable

The multi-turn attack problem is compounded by how deeply — and how quickly — AI has been integrated into enterprise operations.

AI assistants are now tied into ticketing systems, source code repositories, chat platforms, and cloud dashboards. In some environments, these systems can open pull requests, query internal databases, book services, and trigger automated workflows with limited human involvement.

This integration creates enormous blast radius potential.

AI agents are granted 10x more access than their workflows actually need, meaning even a low-sophistication prompt injection attack can yield disproportionate access to sensitive data.

The governance gap makes things worse.

Many deployments moved forward with limited readiness. Most organisations planned to deploy agentic AI into business functions, yet only 29% reported that they were prepared to secure those deployments.

This means the attack surface is growing faster than the defences.

There's also a visibility problem at the detection layer.

Web application firewalls and endpoint detection and response platforms were built to pattern-match against known malicious payloads in network traffic and process execution — but prompt injection bypasses both because the payload IS the content the system is supposed to process.

Conventional tools are simply not looking in the right place.

The Shadow AI and Governance Crisis Underneath

Multi-turn attacks don't exist in a vacuum. They thrive in an environment already weakened by fragmented AI governance — a problem that most enterprises are still struggling to solve.

Shadow AI represents an existential threat to enterprise data security, with 49% of organisations expecting Shadow AI incidents within the next 12 months.

Employees using unsanctioned AI tools create inventory blind spots that compound every other risk category.

Thousands of AI agents are deployed weekly without IT or security oversight, creating inventory gaps that compound the threat surface.

Unlike previous technology transitions where existing frameworks could be adapted to new technologies, AI is changing the nature of risk itself. The challenges enterprises face are deeply interconnected — governance gaps directly contribute to fragmented ownership, which in turn explains why organisations expect widespread incidents while remaining unprepared.

For the first time, security leaders have ranked AI and large language models as their top cybersecurity concern, overtaking ransomware and traditional malware.

That shift reflects a hard-won recognition that AI security is no longer a niche discipline — it is the frontier of enterprise risk management.

The Regulatory Clock Is Ticking

CISOs who might be tempted to deprioritise AI security in favour of more familiar threats should note that regulators are closing the window fast.

The bulk of the EU AI Act's obligations for high-risk systems begin applying on 2 August 2026, with penalties that can reach 7% of global annual turnover.

Incident reporting timelines are equally unforgiving.

DORA gives a four-hour notification window for major incidents, NIS2 requires a 24-hour early warning, and New York's RAISE Act sets a 72-hour reporting clock for frontier model incidents.

In a world where

CrowdStrike's 2025 Global Threat Report documents AI system breakout times as fast as 51 seconds

, meeting those windows requires detection infrastructure that doesn't yet exist in most enterprises.

Gartner predicts 25% of enterprise breaches will trace to AI agent abuse by 2028.

The window to build defences is now — not after the first major incident.

Practical Tips: What CISOs Can Do Right Now

The threat is real, but it is not unmanageable. Here is a prioritised action plan:

1. Replace single-turn red-teaming with multi-turn adversarial testing.

When Cisco ran multi-turn attacks, success rates hit 88.3% — a figure that should worry anyone still running single-turn red-teaming programs.

Mandate that your red team and any third-party testers specifically simulate Crescendo-style, conversation-spanning attack chains against every deployed model.

2. Implement stateful context tracking across all AI interfaces.

Implement stateful context tracking — multi-turn Crescendo-style attacks defeat single-request inspection entirely.

Your monitoring must evaluate the cumulative intent of a conversation, not just individual messages.

3. Enforce least-privilege access for every AI agent.

Just 32% of enterprises give every agent its own scoped, managed identity, and fewer still — 30% — isolate their highest-risk agents in sandboxes.

Correcting this is one of the most impactful things a CISO can do immediately.

4. Build a formal AI asset inventory.

Your organisation cannot secure what it cannot see. Establishing a formal AI governance framework is the foundational AI security best practice, moving your programme from reactive defence to strategic risk management.

Start with a comprehensive audit of every deployed model, integration, and agentic workflow.

5. Integrate AI red-teaming into your CI/CD pipeline.

AI red-teaming — ethical hacking where security teams proactively search for vulnerabilities in AI systems — is essential for discovering how models react to unexpected or malicious inputs. As recommended by CISA, this type of adversarial testing is critical.

Make it a gate, not an afterthought.

6. Monitor the retrieval pipeline, not just the perimeter.

Visibility into what the LLM is receiving and reasoning about — not just what arrives at the perimeter — is essential. Start with retrieval pipeline logging, because indirect injection via document content is the highest-volume attack path in current production deployments.

7. Invest in specialised AI security talent.

Defending AI systems requires specialised skills — enterprises must train or hire experts in adversarial machine learning, AI ethics, and data security.

General cybersecurity skills are necessary but not sufficient.

Conclusion: The Security Gap Is a Leadership Problem

Multi-turn AI attacks represent more than a technical challenge — they are a leadership test. The data is unambiguous: frontier models are failing under extended adversarial conversations at rates that no enterprise can afford to ignore, and the governance, tooling, and talent to stop these attacks remain underdeveloped across most organisations.

Enterprises can no longer treat AI security as an afterthought. Comprehensive AI cybersecurity governance is no longer optional — it is a requirement for survival and success.

Ready to close your enterprise's AI security gap? Start by auditing your current AI deployments for multi-turn attack exposure, establishing conversation-level monitoring across every model interface, and bringing your red-team programme up to speed with the latest adversarial techniques. The organisations that act now will not be scrambling when the first major multi-turn breach makes headlines — and in today's environment, that moment is a matter of when, not if.