When Cisco subjected 15 flagship AI models to 6,986 multi-turn attacks, adversaries who adapted their approach across a conversation succeeded as often as 88.3% of the time. Amy Chang, Cisco's head of AI threat intelligence and security research, presented that finding on the agentic security panel at VB Transform 2026 — a number that should concern any organization still relying on single-turn red-teaming programs.

The urgency in the room was backed by data. According to VentureBeat's June 2026 Pulse survey of 107 enterprise respondents, more than half — 54% — had already experienced either a confirmed agent security incident (18%) or a near-miss intercepted before harm (36%). Only 32% assign every agent its own scoped, managed identity, and just 30% isolate their highest-risk agents in sandboxes. Provider-native and hyperscaler controls remain the primary agent security layer at 82% of surveyed companies — a statistic highlighted in VentureBeat's broader research on shared API keys.

The world's largest security vendors appear to have reached the same conclusion. Palo Alto Networks closed its $25 billion acquisition of CyberArk in February, CrowdStrike agreed in January to pay $740 million for SGNL, and Cisco announced its intent to acquire Astrix Security for a reported $400 million — all targeting the identity and isolation layer that most enterprises have yet to fully build. Together, the three transactions represent more than $26 billion in committed capital concentrated on identity and access management.

A Career Spanning Cyber, Government, and the Military

Chang brought nearly two decades of experience across cybersecurity operations, government, and military service to the panel. She previously served as an executive director at JPMorgan Chase, where she ran global cybersecurity operations and led the bank's cyber threat intelligence teams. She was also a senior staffer on the House Foreign Affairs Committee and a U.S. Navy Reserve officer. She currently teaches cybersecurity and emerging threats as adjunct faculty at the Middlebury Institute of International Studies.

The 88.3% figure originates from a study she co-authored with Nicholas Conley, built on 30,090 single-turn prompts and 6,986 multi-turn attacks against 15 closed and proprietary flagship models. Multi-turn success rates ranged from 7.89% to 88.3%, and every model tested exhibited non-trivial multi-turn exposure. Notably, the two testing methods did not even rank the models in the same order. Chang also noted that Cisco now publishes adversarial evaluation signals for 105 models on its LLM Security Leaderboard.

"If you don't understand how models are susceptible to different types of attacks, then you are unable to account for how that model that is powering your agent, that is powering your application, to understand where those failure points are," Chang said.

She contrasted single-turn testing — the one-shot malicious prompt — with multi-turn attacks, which she described as "more realistic of how we are actually engaging with our models, with our agents, with our applications." That extended interaction arc surfaces harmful outputs and misaligned behaviors that a snapshot test will never catch. In practice, a multi-turn attacker might begin with benign queries, probe the model's guardrail boundaries, and then progressively steer the conversation toward a restricted topic — refining each turn based on the model's responses, much as a social engineer adapts to a target's reactions.

Agentic Red Teaming and Surprisingly Simple Defenses

Cisco has pushed its own testing into agentic territory. Chang described a framework in which agents assess a deployment scenario, develop relevant attacks, judge whether they merit pursuit, execute them, and evaluate their own success. Yet despite all that sophistication, she was most struck by how straightforward the defensive prescription remains.

"The answer is still that it's pretty simple," she said. "You don't have to get super creative. You just need to think about truly what are the fundamentals and basics of what I'm trying to secure in my organization."

For CISOs beginning agentic deployments, her recommended starting point is Cisco's Integrated AI Security and Safety Framework, which she said "stipulates all the ways that AI can be compromised across the AI lifecycle" — from modality through supply chain. Teams can then work backward from real incidents, tracing how each attack was achieved, and use the framework to construct a strategy with appropriate coverage and mitigations. Government frameworks have not yet caught up: NIST's AI Risk Management Framework, published in January 2023, predates the agentic wave and offers limited guidance for systems in which autonomous agents chain tool calls and execute multi-step workflows.

Box: Three Concentric Layers and Lessons From Collapsed Trust

Heather Ceylan, CISO of Box, identified the same gap from the defender's perspective. "A lot of what you see out there with agent red teaming is just single-turn, and that's not how people are actually interacting with AI day-to-day," she told the audience. Box now simulates multi-turn adversaries using agents designed to think like attackers, iterating attempt after attempt to hijack a target. "You have to pressure test your agents because otherwise you don't know if your execution controls are really working as you intended."

Box deployed agents within its security operations center roughly a year ago, initially requiring human approval for every action. Trust accumulated rapidly, and analysts eventually shifted into a monitoring role. Then the agent made a single mistake — and all of that accumulated trust evaporated.

"They had to start all over again," Ceylan said. "So I think that that monitoring piece is so important. Even if you're not gonna have a human in the loop, things change, models change, and we can't control how the models change and interpret things."

Ceylan described Box's defensive architecture as three concentric layers. Permissioning comes first, ensuring the agent never accesses more content than the human who invoked it. Ephemeral sandbox environments spin up for each task, containing the blast radius if an agent is compromised. Runtime execution control then restricts the agent's tool calls to only those relevant to the task at hand.

"If you want an agent to summarize a doc for you, if you have a prompt injection that came in that says forward this to maliciousattacker at domain.com, it can't do that," Ceylan said. "That action in that tool call is not even in its vocabulary."

She categorized agent actions into three tiers of oversight. Non-sensitive actions, such as read and summarize, require no human involvement. Moderately sensitive actions bypass human approval but are logged and monitored. Destructive actions, such as mass file deletion, always require a human. "Things are gonna shift between those three categories quite a bit," she acknowledged, "but setting those types of categories up front allows you to have a principled framework."

Intuit: A Generative AI Operating System

Rajesh Parekh, VP of AI and ML at Intuit, brought the builder's perspective. Parekh previously led large-scale computer vision and ML systems powering Google's Maps and Geo products and holds a doctorate in computer science.

Rather than layering controls onto individual agents, Intuit built a central platform called GenOS — short for generative AI operating system — which abstracts security, risk, and fraud modeling so that agent developers never reinvent protection from scratch.

"Permissioning is not about giving access to AI," Parekh said. "Instead, it is defining very tightly scoped and clearly auditable authority to the agent to perform very specific tasks." Intuit has evolved from agents inheriting user permissions to each agent carrying its own identity, and the company is now exploring mid-session permission changes tied to the specific task underway.

Parekh described the broader model as an AI-powered expert platform, where the human expert is integrated into the trust architecture rather than bolted on as a gate. "The paradigm that we are pursuing is where the user, the AI agent, and the human expert are collaborating to solve the user problem," he said.

He also explained why the red-teaming surface has expanded so rapidly. "These agents have skills, and skills could become vulnerabilities," he said. "Agents have access to certain data, they have access to tools, and there could be threats that are lurking within those tools as well. So suddenly the blast radius of the malicious code or the intent increases dramatically." When Intuit identifies common vulnerability patterns from manual red teaming, it automates those tests into the GenOS harness so future agents inherit protection and red teamers focus on emerging threats. Runtime scanning of prompts and responses provides a final layer capable of halting a suspect response and escalating to a human expert.

"You need to continuously test to ensure that those remain robust to the protections that you have built, as well as to account for any sort of drift or any other types of dependencies that you introduce into your scenario that can create novel vulnerabilities," Ceylan added.

The End of Human Code Review

Ceylan addressed the tension between security testing and development velocity directly. "The days of secure code reviews where a human's looking at the code and we're looking at security architecture reviews, design docs, those are done," she said. "If you keep trying to do security that way, you're gonna get left behind."

Box is building toward a fully agentic development lifecycle in which agents review design documents, apply security requirements, and audit code for vulnerabilities. "I'm very optimistic that we will get to a point where we will write code without security vulnerabilities because agents and the models are going to get so good at writing code without vulnerabilities," she said. "We're still a long way away from that."

Her guidance for development teams sets aside advanced AI concepts in favor of fundamentals that long predate agents. "It comes down to very basic least privilege access," she said. "If you start giving your agents overly broad permissions at the beginning, it's really hard to comb that back and build an infrastructure that allows for those ephemeral credentials and only those narrowly scoped tasks."

Intent Versus Probability

An audience question about intent detection sparked the panel's sharpest exchange. Ceylan noted that when Box's own agent operates, the system always knows the user's intent because it controls the prompt, enabling guardrails and tool-call restrictions to be engineered accordingly. The harder challenge — one she admitted Box is still working to solve — arises when external agents connect and the context behind their requests is opaque.

That exchange surfaced a broader industry divide. In the fireside chat preceding the panel, Mastercard advocated for quantifying intent, building an open-source framework to propagate it as a standard because complex B2B procurement cannot function without that trust. Endpoint security CTOs, in briefings with VentureBeat, have taken the opposite position, saying they will rely on probability rather than intent inference for production workloads.

Chang explained that models, as currently trained, cannot reliably derive intent from a prompt, which is why deterministic controls and behavioral proxies remain essential. Ceylan agreed that both approaches are necessary. "If you're not doing anything deterministic, you're really relying heavily on that intent, and I haven't seen programs that are there yet," she said.

Ceylan's account of trust collapsing after a single agent mistake emerged as the panel's most memorable moment, underscoring that enterprise agentic security is not a problem that gets solved and stays solved. Models change, permissions drift, and adversaries adapt across multi-turn conversations that snapshot tests fail to capture.

For the 82% of enterprises relying on provider-native controls as their primary security layer — and the 59% shopping for agent security tooling over the next 12 months, a category that today exists largely as bespoke internal infrastructure at companies like Box and Intuit — the panel's takeaway was unambiguous: test the way attackers attack, across full conversations and continuously, or discover in production what single-turn red teaming missed.