Summary: Cisco’s May 27, 2026 study attacked 15 closed frontier models from five labs and found none immune to multi-turn attacks. Multi-turn success ranged from 7.89% to 88.30%, compared with 2.19% to 64.91% for single-turn attacks. The same Grok 4.1 Fast model shifted by more than 40 points when reasoning mode changed.
A Cisco study wears its conclusion on its sleeve: “Proprietary Problems: No Frontier Model Is Multi-Turn Immune.” The company’s AI threat research team released the work on May 27, 2026, throwing both single-turn and multi-turn attacks at 15 closed frontier models drawn from five labs. Not one of the fifteen came through the iterative barrage intact — multi-turn success peaked at 88.30%.
Treat this as an operational warning, not an academic footnote. Cisco ranks among the leading suppliers in enterprise security, and what it publishes moves procurement: the AI Defense product line and the company’s LLM security leaderboard both shape how corporations pick models. If the vendor itself is saying that single-turn benchmark scores cannot stand in for safety, any team that vets models through model cards and public leaderboards owes its own process a fresh look.
Inside the Evaluation
One harness and one set of prompt banks covered every trial: 30,090 single-turn prompts in total, 2,006 apiece per model, alongside 6,986 multi-turn attacks threaded through 1,456 conversations. The lineup reads like a census of the current frontier — OpenAI’s GPT-5.2 and GPT-5.4 families; Anthropic’s Claude Opus 4.5/4.6, Sonnet 4.5/4.6, and Haiku 4.5; Google’s Gemini 3 Pro; Amazon’s Nova Lite, Nova Micro, and Nova 2 Lite; plus xAI’s Grok 4.1 Fast, run in both reasoning and non-reasoning configurations.
There is a direct predecessor here. In November 2025 Cisco published “Death by a Thousand Prompts,” an evaluation of eight open-weight models in which multi-turn attacks succeeded 92.78% of the time against Mistral Large-2. Aiming the same machinery at closed models delivered an identical verdict: fragility under iterative attacks is built into today’s frontier, regardless of whether weights are open or which alignment philosophy a lab follows.
The Five Families of Attack
These campaigns do not repeat one bad question until the model caves. They split a harmful request into pieces, reframe it, and raise the temperature turn by turn. Cisco filed the observed techniques under five strategy families: role-play and persona adoption, contextual ambiguity and misdirection, refusal reframing and redirection, information decomposition and reassembly, and crescendo escalation. Amy Chang, head of AI threat intelligence and security research at Cisco, compressed the threat into one sentence: “Real adversaries won’t stop at the first refusal.”
What the Data Shows
- Across the cohort, multi-turn attacks connected between 7.89% and 88.30% of the time, while single-turn attempts stayed within 2.19% to 64.91%
- Claude models moved from 2.19–3.64% to 11.16–16.20% — a real erosion, yet still the toughest defense in the field
- GPT-5.4 leapt from 2.74% to 24.68%, an increase of roughly 9x
- Gemini 3 Pro surged from 18.10% to 73.35%, adding upward of 55 percentage points
- The 88.30% high mark belonged to Grok 4.1 Fast with reasoning off; switching reasoning on pulled it down to 43.47%
- Amazon’s Nova 2 Lite swims against the current: 34.05% single-turn against a field-low 7.89% multi-turn
For more than half the models, the two regimes sat at least 15 percentage points apart, and each mode generated its own rankings, failure maps, and tail-risk profile. Chang’s assessment of standard benchmarks is unsparing: “Single-turn benchmark scores demonstrate how a model performs in scenarios that attackers don’t use.”
One Toggle, Two Safety Postures
The finding that deserves the loudest alarm is the reasoning-mode switch: the very same Grok 4.1 Fast swung by over 40 points on nothing more than a configuration change. Public benchmarks and model cards surface none of that spread, so two teams shipping the “same” model may in practice hold very different levels of protection. The result slots into the broader prompt-injection picture — recently documented domain-camouflaged injections, for one, are likewise engineered to slip past static defenses.
What Buyers and Governance Teams Should Do
Cisco’s guidance comes down to three practices:
- With every model release, publish success rates split by strategy family instead of an aggregate score alone
- Build deployment gates around the top three failure procedures and content types, holding back any release that regresses by more than 3 percentage points
- Route every model whose cross-regime gap exceeds 15 percentage points into manual review — applied to this study, the rule flags 8 of the 15 models
The regulatory layer shares the blind spot: the NIST AI RMF, the draft NIST IR 8596, and Article 15 of the EU AI Act each mandate adversarial robustness testing, yet none of them addresses interaction regimes or strategy decomposition. Cisco’s parting argument is blunt: with no base model safe under iterative attack, the security perimeter has to live outside the model — in runtime guardrails, monitoring, red-teaming, and application-layer policy. As Chang summarized: “Guardrails attenuate risk but do not eliminate it.”