Frontier AI models are more vulnerable to malicious prompts than vendors claim

Key Takeaways

• Cisco researchers said in a report released Wednesday that major AI developers' claims about model safety are built on incorrect assumptions about how hackers operate.
• AI vendors assume that as long as a model can resist a single malicious prompt, it is safe from hijacking; but Cisco says hackers are increasingly using multi-stage prompts to bypass model defenses, and most models are not prepared for such attacks.
• The new report reveals a danger that is largely underappreciated in AI models, which could expose enterprises using these tools to widespread disruption and damage.

Deep Dive

Cisco's evaluation of 15 leading AI models from OpenAI, Anthropic, Google, Amazon, and xAI found that "single-turn attack success rate (ASR) does not reliably reflect what happens when an attacker can adapt across turns," researchers Nicholas Conley and Amy Chang wrote.

Their tests showed that AI models are significantly more vulnerable to multi-turn malicious prompts—with multi-turn attack success rates ranging from 8% to 88%, compared to single-turn prompt success rates of only 2% to 65%.

"Every model we tested exhibited a non-negligible multi-turn ASR," Conley and Chang wrote.

The two researchers previously co-authored a November 2025 report that found open-weight AI models are two to ten times more vulnerable to multi-turn attacks than to single-turn attacks.

"The patterns we documented in open models are also present in closed models," they wrote in the new study. "No frontier closed model in this cohort can be described as safe under iterative attacks. This is a statement about the current state of the closed-model frontier, not a critique of any single vendor."

One of the study's most important findings is the correlation between AI companies' priorities and their models' safety. Conley and Chang found that AI developers that publicly emphasize their models' increasing capabilities showed the largest gap between their models' vulnerability to single-turn and multi-turn attacks. Developers whose public statements emphasized model safety showed smaller gaps, suggesting more coordinated efforts to reduce risk.

The researchers tested five strategies: role-playing, misleading the model, information decomposition, reframing model refusals, and gradual escalation. xAI's model Grok 4.1 Fast Non-Reasoning performed worst, with researchers achieving an 88% success rate in multi-turn attacks (compared to a 34% single-turn attack success rate against the model).

The best-performing model was Amazon's Nova 2 Lite, which failed to resist only 8% of multi-stage attacks, though the researchers noted that this figure "still represents meaningful residual risk."

Conley and Chang noted that Grok 4.1 showed significant improvement when reasoning was enabled, suggesting that AI vendors should "document the security impact of configuration decisions such as reasoning state."

OpenAI, Anthropic, Google, Amazon, and xAI did not immediately respond to requests for comment.

The researchers said vendors need to rethink how they evaluate AI model safety, and enterprises need more information about the potential gap between models' resilience to single-turn versus multi-turn attacks.

"Business decisions based on published single-turn scores carry security and governance risks," Conley and Chang wrote. "A model with a single-turn ASR of 2.74% is not the same product as a model with a multi-turn ASR of 24.68%. Without paired-scenario data, the two are indistinguishable in most public evaluations, and end users never see this gap."