At VB Transform 2026, Amy Chang — head of AI threat intelligence and security research at Cisco — reported a striking result from Cisco’s evaluation: adaptive multi‑turn attacks succeeded against 15 closed flagship models as often as 88.3% in the worst cases. Chang warned that single‑turn red‑teaming misses important attack surfaces when agents engage across longer conversations.
Survey data and real incidents
VentureBeat’s June 2026 Pulse survey of 107 enterprise respondents helps explain industry concern: 54% of companies reported either a confirmed agent security incident (18%) or a near‑miss caught before harm (36%). Only 32% assign every agent its own scoped, managed identity, and 30% isolate their highest‑risk agents in sandboxes. Provider‑native and hyperscaler controls remain the primary security layer for 82% of respondents.
Study details: prompts, attacks, and model exposure
The study Chang co‑authored with Nicholas Conley ran 30,090 single‑turn prompts and 6,986 multi‑turn attacks against 15 closed proprietary flagship models. Multi‑turn success rates ranged from 7.89% to 88.3%; every tested model showed non‑trivial exposure under multi‑turn attacks. Notably, rankings produced by single‑turn and multi‑turn testing differed. Cisco now publishes adversarial evaluation signals for 105 models on its LLM Security Leaderboard.
Chang emphasized the difference between testing styles: single‑turn tests are one‑shot malicious prompts, while extended multi‑turn attacks better reflect how users interact with agents and applications. Longer attack arcs surface harmful outputs and misalignments that snapshot tests often miss.
Defensive simplicity amid complex testing
Cisco’s testing framework pushes agentic techniques into the evaluation: agents assess deployment scenarios, craft and judge attacks, execute them, and evaluate results. Despite that sophistication, Chang said the defensive answer often remains straightforward: enforce fundamentals such as least privilege, identity, and isolation.
She recommended Cisco’s Integrated AI Security and Safety Framework as a starting point for CISOs. The framework catalogs ways AI can be compromised across the lifecycle — from modality to supply chain — enabling teams to work backward from real incidents to map attack paths and build mitigation strategies.
Enterprise practices: Box and Intuit approaches
Heather Ceylan, CISO of Box, echoed the gap between common testing and real usage: much agent red‑teaming is single‑turn, while day‑to‑day interactions are multi‑turn. Box now simulates multi‑turn adversaries that iterate until they can hijack a target. Box deployed agents in its security operations center about a year ago, with human approval required for every action initially; analysts shifted to monitoring as trust grew, but a single agent mistake erased that trust and forced them to rebuild monitoring.
Ceylan describes Box’s defensive stack as three concentric layers:
- Permissioning: agents should never access more than the invoking human;
- Ephemeral sandboxes for each agent task to limit blast radius;
- Runtime execution controls to restrict tool calls to task‑relevant actions.
She categorizes agent actions into three oversight levels: non‑sensitive (no human-in‑the‑loop), moderately sensitive (logged and monitored without human approval), and destructive (always require human approval). These categories can shift, but defining them up front provides a principled framework.
Rajesh Parekh, VP of AI and ML at Intuit, described a different architectural approach: instead of layering controls on each agent, Intuit built a central platform called GenOS (generative AI operating system) that abstracts security, risk, and fraud modeling so individual agent developers don’t reinvent protections. Intuit moved from agents inheriting user permissions to each agent carrying its own identity and is exploring mid‑session permission changes tied to the specific task.
Parekh calls the result an AI‑powered expert platform, where the human expert is embedded into the trust architecture and collaborates with the user and the AI to solve problems.
Automating red‑team lessons and continuous testing
Intuit automates common vulnerability patterns discovered in manual red‑teaming back into GenOS so future agents inherit protections and red‑teamers focus on new threats. Runtime scanning of prompts and responses adds a final stopgap that can block suspicious outputs and escalate to a human expert.
Ceylan stressed the necessity of continuous testing to ensure protections remain robust against model drift and new dependencies that introduce novel vulnerabilities.
Intent detection vs. probability: an industry split
A panel exchange about intent detection highlighted a split across vendors. Ceylan noted that when Box’s own agent controls the prompt, the system knows the user’s intent and can engineer guardrails accordingly; the harder problem is opaque context from external agents. Some industry actors (Mastercard, in the panel’s preceding fireside chat) favor quantifying and standardizing intent, while many endpoint security CTOs prefer betting on probabilistic approaches for production workloads.
Chang argued that current model training does not reliably infer intent from prompts, so deterministic controls and behavioral proxies remain necessary. Ceylan agreed that both deterministic and probabilistic layers are required.
Takeaway: test the way attackers test
The panel’s closing message was blunt: for the 82% of enterprises relying primarily on provider‑native controls and the 59% planning to shop for agent security tooling in the next 12 months, the choice is clear. Test continuously and across full conversations as attackers do, or discover in production what single‑turn red‑teaming missed. The market is already responding: Palo Alto Networks closed its $25 billion acquisition of CyberArk in February; CrowdStrike agreed in January to pay $740 million for SGNL; and Cisco announced intent to acquire Astrix Security for a reported $400 million — all moves aimed at shoring up identity and isolation layers that many enterprises have yet to complete.
