The headline finding from Cisco's new multi-turn adversarial testing of 15 frontier models is stark enough: attack success rates climbed as high as 88% when researchers were allowed to iterate, adapt, and escalate across conversation turns. But the real story is not the raw number. It is that the single-turn safety scores every vendor publishes, the ones procurement teams and regulators rely on to compare models, produce rankings that fall apart under the conditions actual attackers use. Google's Gemini 3 Pro went from roughly 18% single-turn ASR to 73% under iterative testing. That is not a gap. That is a different security posture masquerading behind the same label.
The stories
Cisco: frontier AI models collapse under multi-turn attacks. The Cisco AI threat intelligence team tested 15 closed flagship models across roughly 30,000 single-turn prompts and 7,000 multi-turn attacks in more than 1,400 conversations. Every model failed a meaningful share of multi-turn attacks. OpenAI's GPT-5.4 jumped roughly ninefold, from low single digits to nearly 25%. xAI's Grok 4.1 Fast in non-reasoning mode hit 88%. Even Anthropic's Claude family, which posted the strongest single-turn refusal rates, landed at 11% to 16% once attackers could adapt. Five strategy families drove most outcomes: role-play, contextual ambiguity, refusal reframing, information decomposition, and crescendo escalation. The practical implication is that your vendor-provided safety scores tell you how a model performs in scenarios attackers do not use. Amy Chang, head of AI threat research at Cisco, put it plainly: real adversaries do not stop at the first refusal. If your model selection process relies on published ASR benchmarks, you are making procurement decisions on data that systematically underestimates risk.
Source: Help Net Security
Malicious npm package targets Anthropic Claude user directory. OX Security disclosed a package called "mouse5212-super-formatter" on npm that exfiltrates files from /mnt/user-data, the directory Anthropic's Claude uses for uploads and outputs. During postinstall, it authenticates to GitHub using either a victim's environment token or a hardcoded fallback, creates a repository if one does not exist, and recursively uploads every file to a threat actor-controlled account. Downloaded 676 times. The package leaked its own GitHub private token, which OX Security says points to AI-generated malware with no operational security discipline. They are calling it Malware-Slop, and the bar to create it is lower than ever. The attack surface here is not just the package. It is the AI tool's local file system, which most users do not realise exists or monitor.
Source: The Hacker News
GPU mining malware spreads via SEO poisoning and AI chatbot recommendations. Microsoft disclosed a cryptojacking campaign that targets systems with high-performance GPUs through SEO poisoning of legitimate utility downloads like CrystalDiskInfo, HWMonitor, and FurMark. The new detail: in April, users querying AI chatbots for software recommendations received links to attacker-controlled domains within the generated responses. The payload uses DLL sideloading to install ScreenConnect for persistent access, then deploys GPU cryptocurrency miners. More than 150 malicious domains identified. This is the second week running we have seen AI chatbot manipulation as a delivery vector. The attack surface is expanding from search engine results to every LLM your users interact with.
Source: BleepingComputer | Microsoft Security Blog
Ketch launches multi-agent AI orchestration for privacy programmes. Ketch released its Agent Network, a multi-agent orchestration layer for enterprise privacy that reasons simultaneously across legal obligations, internal policies, and operational realities. It automates data mapping, risk management, and impact assessments across SaaS and internal systems. The pitch addresses a real gap: privacy teams are drowning in regulation and enforcement pressure, and single-agent tools are not keeping up. Whether a network of agents actually solves that problem in production remains to be seen, but the architecture of reasoning across three domains at once is more ambitious than most of what the market is offering.
Source: Help Net Security
Span CISO on why "humans are the weakest link" is lazy thinking. Hrvoje Englman, CISO at Span, told the Span Cyber Security Arena conference that the industry's favourite framing is wrong. The responsibility sits with the CISO to build systems where a user clicking a malicious link does not bring the environment down. He also described the bus-factor problem in reverse: when an engineer who built five interconnected AI agents leaves, those agents keep running with nobody who understands what they do. On autonomous SOCs, he was blunt: log ingestion remains the hardest part, and detection engineering still depends on people who can explain why an alert fired. Two million alerts mean nothing if your analyst does not understand them.
Source: Help Net Security
Dark Reading: AI-assisted exploit development outpaces scanner detection. New research shows attackers are using AI to compress the time between CVE disclosure and working exploit. The detail that matters is not that AI can write exploits. It is that the speed advantage over traditional exploit development is now wide enough that scanner vendors cannot keep up. The window between vulnerability publication and weaponised exploit has been shrinking for years. AI is making it a sprint.
Source: Dark Reading
What this means
The Cisco research is the most important thing to read here, and not because of the headline number. The finding that more than half the models tested showed a cross-regime gap above 15 points between single-turn and multi-turn ASR means that the benchmark scores your vendor sends you, the ones in the model card, the ones your risk team uses for comparison, are measuring the wrong thing. Amy Chang's three operational recommendations are practical: publish ASR by strategy family on every model release, gate deployments on regressions in the top three procedures, and flag any model with a cross-regime gap above 15 points for manual review. Applied to the cohort, the third rule alone surfaces more than half the tested models. Start there.
The npm package targeting Claude's user directory and the GPU mining campaign that manipulated AI chatbot responses are two sides of the same problem. Your users are interacting with AI tools that have local file systems, generate recommendations, and operate with implicit trust. The attack surface is not just what the model outputs. It is what the model ecosystem touches: package managers, download directories, chat logs, recommendation chains. If you have not mapped your AI tool attack surface, you are flying blind.
Englman's point about the inverted bus-factor problem deserves more attention than it is getting. When a developer leaves an organisation, the five agents they built keep running with their credentials. Nobody knows what those agents do, why they were built, or what breaks if you turn them off. That is not a theoretical risk. It is an operational debt that compounds every time someone on your team spins up an AI-powered workflow without documentation. Start inventorying. Now.