Multi-Turn LLM Jailbreaks: Why Enterprise Guardrails Fall Short

What happened

A cluster of 2026 research is changing how security teams should think about protecting large language models in production. Multi-turn jailbreaks spread a manipulative request across several conversational turns instead of packing it into one prompt. They are reported to succeed up to 99% of the time against every major LLM, according to work presented at ICML 2026 2. The headline summary rounds this to a flat 99% success rate against all major models 1. The fuller account frames it as a ceiling ("up to"), which is an important qualifier when reading the figure.

The practical warning is aimed at enterprises running ChatGPT, Claude and Gemini in live environments. Their attack surface is growing faster than vendor-supplied content filters can contain it 2. The guidance built on this research groups the problem into six attack techniques. It maps them to the OWASP framework and proposes a layered guardrail architecture rather than reliance on a single filter 1.

The research behind the numbers

Two bodies of work anchor the findings. The first is MultiBreak, a benchmark accepted at ICML 2026. It contains 10,389 adversarial prompts covering 2,665 distinct harmful intents 2. That scale matters. A benchmark this broad makes it harder to dismiss high success rates as the product of a few cherry-picked prompts.

The second is a systematization-of-knowledge (SoK) paper that organizes multi-turn jailbreaks by attacker intent 2. Together, these papers point to six primary attack patterns that defenders are urged to understand 2.

The most advanced of the six is the autonomous AI agent attack. In this pattern, one AI model plans, runs and refines a multi-turn attack against a target LLM on its own 2. The SoK paper cites 2026 research in which DeepSeek-R1 and Gemini 2.5 Flash served as autonomous jailbreak planners 2. The consequence is that human ingenuity is no longer the limiting factor, and exploitation can run at scale 2.

Why multi-turn attacks are hard to stop

The core weakness is architectural. Many safety filters judge each prompt more or less on its own merits. A request split into harmless-looking pieces can slip past that kind of inspection, because no single message carries the full harmful intent. The intent only becomes clear across the conversation as a whole. That is presumably why the SoK work organizes its taxonomy around intent rather than surface wording.

The agent-driven variant makes this worse. A human attacker tires, runs out of ideas, and can test only so many conversational paths. An attacking model has none of those limits. It can probe a target repeatedly, keep what works and drop what doesn't. Once attacks are automated, a defense that holds up 95% of the time still leaves a large absolute number of breaches.

What it means for enterprises

The clearest takeaway is that vendor filters are a starting point, not a complete control 2. The proposed response combines OWASP mapping with a dedicated guardrail architecture 1. This suggests the authors see LLM jailbreaks as a standard application-security risk to manage within existing frameworks, not an exotic AI problem left to model providers.

In practice, several steps would follow from that framing:

• Conversation-level monitoring that tracks how a dialogue evolves, not just individual messages.
• Independent guardrail layers placed between users and the model, so a single bypass doesn't compromise the whole system.
• Red-teaming with automated attackers that mirrors the agent-based techniques the research describes.

The second and third points are my own analysis, drawn from where the research says current defenses fail. They are not prescriptions confirmed by the papers' text.

The reading

The 99% figure deserves some care. It is a best-case number for attackers, and the available material doesn't break it down by model, technique or setting. Even with that caveat, the direction is hard to argue with. A peer-reviewed benchmark of more than ten thousand prompts and documented use of frontier models as attack planners mark a real shift.

The most consequential finding isn't the success rate. It is the automation. Once one model can be pointed at another to find a way through, jailbreaking becomes a scalable, repeatable operation. Enterprises that treat their LLM deployments as finished products protected by a vendor filter are, on this evidence, under-defended. A layered architecture that inspects whole conversations and is tested against automated adversaries looks like the minimum, not an optional extra.