Cisco Testing Finds Open-Weight LLMs Highly Susceptible to Multi-Turn Jailbreaks

Cisco reported that multi-turn jailbreak techniques—iterative, conversational prompt sequences designed to erode safety guardrails—successfully bypassed protections in eight major open-weight large language models 92.78% of the time, while single-turn prompt attempts were notably less effective. The findings, published in Cisco’s State of AI Security research and covered by multiple outlets, highlight that many enterprise AI deployments using downloadable, self-hosted models may be more vulnerable to sustained adversarial prompting than organizations assume.

The report’s risk framing is amplified by broader concerns that model misuse and capability leakage can scale quickly: Anthropic separately alleged coordinated model distillation activity by Chinese AI labs using large volumes of fraudulent accounts and proxy infrastructure to extract advanced behaviors from Claude, warning that copied models may lack comparable safety controls and could be repurposed for malicious use. Related research coverage also notes that LLMs can sometimes be induced—via specialized prompting/jailbreaking methods—to reproduce near-verbatim copyrighted text from training data, underscoring that prompt-based attacks can drive both policy bypass and data/content extraction outcomes, particularly when guardrails are tested over extended interactions.