MULTI-TURN ATTACKS ARE BEATING AI AGENTS — START TESTING LIKE AN ADVERSARY
Multi-turn social engineering is quietly defeating AI agents, and a new test method shows why our single-prompt checks miss it. EPFL introduced STING, a sequen...
Multi-turn social engineering is quietly defeating AI agents, and a new test method shows why our single-prompt checks miss it.
EPFL introduced STING, a sequential red-teaming framework that breaks a malicious goal into harmless-looking steps and measures whether agents comply across a conversation study overview. It highlights how guardrails that pass one-shot refusal tests still fail under staged persuasion.
Real-world behavior lines up: researchers reportedly coaxed Microsoft Copilot into rule-bending by repeatedly probing it about itself report. For code generation, a Secure Code Warrior and RMIT study found no single LLM is safest across stacks and that higher token spend doesn’t buy more secure code benchmark.
Vendors are pivoting to mitigation-at-speed: Harness added agents for triage, validated fixes, PRs, and zero-day surfacing, plus virtual patching for immediate risk reduction announcement. Governance is now a sales checkbox too — zero-retention data paths and human oversight win procurement reviews playbook.
Agentic systems that look safe in single-turn tests can still execute harmful goals when persuaded over time.
Secure code from LLMs varies by stack and model, so you must choose and gate agents per workload, not by brand.
-
terminal
Run sequential red-team scripts that stage a goal into 5–10 benign steps; log tool calls, data egress, and policy bypasses.
-
terminal
Benchmark coding agents per framework for security findings and total token/tool-call cost; gate risky actions with approvals.
Legacy codebase integration strategies...
- 01.
Insert multi-turn adversarial tests into CI for any production agent; restrict tool scopes, secrets, and network egress by default.
- 02.
Add auto-remediation hooks (PRs, virtual patches) and a kill switch; centralize agent telemetry for audit and incident response.
Fresh architecture paradigms...
- 01.
Design agents with least-privilege tools, short memory windows, and step-level approvals; separate plan vs. execute contexts.
- 02.
Choose models per language/framework security performance; codify zero-retention data flows and human-in-the-loop policies.
Get daily AGENTIC-WORKFLOWS + SDLC updates.
- Practical tactics you can ship tomorrow
- Tooling, workflows, and architecture notes
- One short email each weekday