Leading AI models are more vulnerable to malicious prompts than vendors claim

Cisco’s evaluation of 15 leading AI models from OpenAI, Anthropic, Google, Amazon and xAI “found that single-turn attack success rate (ASR) is not a reliable proxy for what happens when an attacker can adapt across turns,” researchers Nicholas Conley and Amy Chang wrote. Their tests revealed that AI models were much more susceptible to multi-turn malicious prompts — success rates ranged from 8% to 88%, compared with a range of 2% to 65% for single-turn prompts.

“Every model we tested exhibited non-trivial multi-turn ASR,” Conley and Chang wrote.

The two researchers previously collaborated on a November 2025 report that found open-weight AI models were between two and 10 times as vulnerable to multi-turn attacks as they were to single-turn attacks.

Read more at Cybersecurity Dive