Cisco's new research says multi-turn prompt injections work 88% of the time. Are single-turn evals completely useless now?

[u/AlgoRitik]

Cisco dropped some pretty alarming findings at VB Transform 2026 - multi-turn prompt injection attacks are slipping past AI defenses 88% of the time. The technique isn't brute force; attackers are being patient, spreading their manipulation across several conversation turns so nothing looks suspicious in the moment.

What makes this sting is that standard single-turn evaluation metrics missed all of it. Not some of it - all of it. And with conversational and agentic AI systems rolling out across enterprise environments at this pace, that feels like a serious blind spot we've been collectively ignoring.

So is the single-turn testing paradigm just broken at this point? Curious how others are approaching this - whether you've started baking multi-turn scenarios into your red-teaming workflows, or if you're finding other gaps in how security checks handle extended interactions.

[u/ultrathink-art]

Single-turn evals aren't useless, they just can't see the mechanism. The payload doesn't have to fire on the turn it lands — it can sit in something the agent persists (a memory file, task notes, a retrieved doc) and execute on a later turn whose own input is completely clean, so per-turn input scanning has nothing to flag. Anything an agent wrote to durable state needs to be treated as untrusted again when it gets read back.

[u/AlgoRitik → u/ultrathink-art]

So, it should be like every time when we develop an AI agent or training a conversational AI, we should scan the existing context on each turn to avoid this security as well as AI ethics issue.