For months, the prevailing wisdom in AI red teaming has been centered on the single-shot prompt. Security teams have spent countless hours crafting the perfect 'jailbreak'—a single, complex paragraph designed to trick a Large Language Model into ignoring its safety guidelines. If the model resisted these one-off attempts, it was deemed secure. This approach created a dangerous illusion of safety, treating AI security as a static wall to be breached rather than a dynamic conversation to be manipulated.
The failure of static red teaming
New research presented at VB Transform 2026 by Cisco reveals that this single-turn mindset is fundamentally flawed. In a comprehensive study involving 15 flagship AI models and 6,986 targeted attacks, Cisco found that multi-turn attacks—where an attacker iteratively adjusts their strategy based on the model's responses—successfully breached security defenses 88.3% of the time. This is a staggering contrast to single-turn tests, which often failed to uncover the same vulnerabilities. The data suggests that as a conversation progresses and context accumulates, the model's ability to maintain strict security controls degrades.
This vulnerability is exacerbated by a widespread reliance on basic safety measures. According to the study, 82% of surveyed companies rely exclusively on the default controls provided by the AI service provider as their primary security layer. This creates a systemic fragility across the enterprise AI landscape. Only 32% of organizations have implemented separate management IDs to restrict agent permissions, and a mere 30% utilize sandboxing to isolate high-risk agents from the broader system. The gap between the sophistication of multi-turn attacks and the simplicity of current corporate defenses is widening.
Shifting from model safety to agent isolation
The critical insight from Cisco's findings is that the vulnerability does not lie solely within the model's weights, but in the architecture of the agent's environment. When an attacker uses a multi-turn approach, they are not just attacking a prompt; they are probing the boundaries of the agent's authority. This realization has shifted the security conversation from prompt filtering to a three-tier isolation strategy, a model currently championed by Box.
First, the architecture implements strict authorization to ensure an agent cannot access more content than the user who invoked it. Second, it employs ephemeral sandboxes, creating a fresh, isolated virtual execution space for every single task. This ensures that even if an agent is compromised during a session, the blast radius is contained, and the attacker cannot pivot to other system resources. Finally, runtime execution control limits tool calls to only those functions strictly necessary for the immediate task, effectively neutralizing prompt injection attempts that seek to hijack system commands.
To validate these defenses, Cisco has moved beyond human-led red teaming toward an agentic testing framework. In this setup, an AI agent is tasked with acting as the attacker. This adversarial AI evaluates deployment scenarios, develops custom attack vectors, determines the viability of those attacks, and then executes them to judge the success of the breach. By replicating the iterative logic of a human hacker, this framework can identify the exact point where a model's security collapses during a long-form conversation.
This shift in strategy is reflected in the current market volatility and M&A activity. A June 2026 survey of 107 companies revealed that 54% had either suffered an AI agent security incident or narrowly avoided one, with 18% reporting actual breaches and 36% reporting near misses. The financial industry is responding with massive capital infusions into identity and isolation technologies. Palo Alto Networks acquired CyberArk for $25 billion to bolster account and privilege management, while CrowdStrike committed $740 million to SGNL. Cisco itself announced a $400 million acquisition of Astrix Security to strengthen the very isolation layers—authorization, sandboxing, and runtime control—that the research proves are necessary.
The era of trusting default AI safety filters is over, replaced by a mandatory requirement for rigorous agentic isolation.
