When it performed 6,986 multi-array attacks against Cisco 15 flagship modelsattackers who adapted to chat broke as often as 88.3% of the time. Amy Chang, Cisco’s head of AI threat intelligence and security research, reported the finding to the agent security panel. VB Transform 2026; This number should concern anyone who still runs disposable red team programs.
VentureBeat’s June 2026 Pulse survey of 107 enterprise respondents explains why the room is full. More than half, 54%, have already experienced a confirmed agent security incident (18%) or a hijack that was caught before harm was done (36%). Only 32% give each agent its own comprehensive, managed identity, and even fewer, 30%, isolate their highest-risk agents in sandboxes. The provider’s local and hyperscale controls remain the primary agent security layer 82% of companies surveyed. The world’s largest security vendors have made the same calculation.
Palo Alto Networks shut down Acquisition of CyberArk for $25 billion CrowdStrike in February agreed to pay $740 million for SGNL in Januaryand Cisco announced it Astrix Security intends to acquire for a reported $400 million, all of which went into the identity and insulation layer, most facilities have not completed construction.
Chang comes to the panel with almost two decades of experience spanning cybersecurity operations, government and the military. He led global cybersecurity operations as an executive at JPMorgan Chase, where he led the bank’s cybersecurity intelligence teams, served as a senior staff member on the House Foreign Affairs Committee, and as a U.S. Navy Reserve officer. He also teaches cybersecurity and emerging threats as an adjunct faculty at the Middlebury Institute for International Studies.
Chang’s 88.3% number comes from a study he co-authored with Nicholas Conley based on 30,090 single-cycle orders and 6,986 multi-cycle attacks against these 15 closed and proprietary flagship models. Multicycle success rates ranged from 7.89% to 88.3%, with every model tested showing non-trivial multicycle exposure, and the two testing styles did not even rank the models in the same order. Cisco currently publishes competitor evaluation signals for 105 models LLM Security Leaderboardhe told the audience.
"If you don’t understand how the models are vulnerable to different types of attacks, then you can’t understand where those points of failure are in the model that powers your agent, powers your application." Chang said. A single-turn trial is a one-shot damaging instruction, while expanding the attack into a longer conversation, he said. "more realistic to how we actually deal with our models, our agents, our applications." This longer arc reveals malicious outputs and misaligned behaviors that a snapshot would never catch.
Cisco pushed the test itself into agent territory. Chang described a framework in which agents evaluate a deployment scenario, design appropriate attacks, judge whether they are worth pursuing, execute them, and evaluate their success. After all that sophistication, what surprised him the most was how simple the defensive response was. "The answer is still quite simple," he said. "You don’t have to be super creative. You just have to think about what are the fundamentals and fundamentals of what I am trying to provide in my organization."
For CISOs starting to deploy an agent, Cisco is the starting point Integrated AI Safety and Security Frameworkhe said "It dictates all the ways AI can break throughout the AI lifecycle" from modality to supply chain. From there, teams can work backwards from real incidents, track how each attack was achieved, and use the framework to strategize with the right scope and mitigation.
Heather Ceylan, Box’s CISO, sees the same gap on the defender side. "A lot of what you see there with the agent red team is just one turn and that’s not how humans interact with AI every day." he told the audience. Box now simulates multi-turn enemies with agents that think like attackers and retry after trying to miss a target. "You need to test your agents, because otherwise you don’t know if your execution controls are actually working as you intended."
Box put agents into its security operations center about a year ago, starting with the human approval required for every action and building trust quickly enough for analysts to go into monitoring mode. Then the agent made a mistake and every bit of that accumulated trust was gone. "They had to start over." he said. "Therefore, I think that this monitoring is very important. Even if you’re not a human in the loop, things change, models change, and we can’t control how models change and interpret things."
Rajesh Parekh, VP of AI and ML at Intuit, brought a builder’s perspective. Prior to joining Intuit, Parekh led the large-scale computer vision and ML systems powering Google’s Maps and Geo products and holds a PhD in computer science.
Three layers against the operating system
Ceylan described Box’s approach as three concentric layers. Permission comes first, so the agent never has access to more content than the person who triggered it. Ephemeral sandbox environments are spun up for each agent task that contains the blast radius when the agent is hijacked, and runtime control limits the agent’s tool calls to only those appropriate for the task. "If you want an agent to digest a document for you, if domain.com has an emergency injection that says redirect to a malicious attacker, it can’t do that." Ceylan said. "In this tool call, this action is not even in its vocabulary."
He classified agent actions into three control categories. Non-sensitive operations such as reading and summarizing do not need a human in the circuit. Moderately sensitive activities bypass human approval but are logged and monitored, while destructive actions such as mass file deletion always require a human. "Things will vary slightly between these three categories," he admitted "however, foregrounding these types of categories allows for a principled framework."
Instead of adding controls to individual agents, Intuit built a central platform called GenOS, short for a generative AI operating system that abstracts security, risk and fraud modeling, so individual agent developers never have to reinvent defenses. "Giving permission is not giving access to artificial intelligence." Parekh said. "Instead, it defines a very precisely scoped and clearly verifiable authority for the agent to perform very specific tasks." Intuit has evolved from agents inheriting user permissions to each agent carrying its own identity, and the company now investigates mid-session permission changes related to a specific task being performed.
Parekh calls the broader model an AI-powered expert platform, where the human expert is embedded into the trust architecture rather than as a gateway. "The paradigm we follow is where a user, an AI agent, and a human expert collaborate to solve a user problem." he said.
End of human code review
Ceylan took on the tension between security testing and development speed without hedging. "The days of secure code reviews, where a human looked at the code and we looked at security architecture reviews, design documents, those are over," he said. "If you continue to provide security in this way, you will be left behind." Box is building toward a full agent development cycle where agents review design documents, enforce security requirements, and review code for vulnerabilities. "I am very optimistic that we will get to a point where we can write code without security vulnerabilities, because agents and models will be very good at writing code without vulnerabilities." he said. "We are still far from that."
His advice for development teams skips advanced AI concepts entirely and goes back to the basics that predate agents. "It comes down to very simple least privileged access," he said. "If you start giving your agents too broad permissions in the beginning, it’s really hard to reverse that and build an infrastructure that allows for these ephemeral credentials and only narrow-scoped tasks."
Parekh explained why the red team surface expanded so quickly. "These agents have skills, and skills can become weaknesses," he said. "Agents have access to certain information, they have access to tools, and within these tools there may be hidden threats. So suddenly the blast radius or intent of the malicious code increases dramatically." When Intuit identifies common vulnerability patterns from manual red teaming exercises, it automates those tests back into GenOS harnesses so that future agents inherit the defenses and red teams focus on new threat vectors. Runtime scanning of requests and responses adds a final layer that can intercept a suspicious response and deliver it to a human expert, he said.
"You should continuously test them to ensure they are resilient to the protections you have built in, as well as to account for any type of slippage or any other types of dependencies that may introduce new vulnerabilities in your scenario." he said.
Intent and probability
An audience question about detecting intent led to the most heated exchange of the session. Ceylan noted that when Box’s own agent is running, the system always knows the user’s intent because it controls the command, meaning guardrails and tool-call restrictions can be created around it. A trickier problem, which Box admits it’s still trying to solve, comes when external agents are involved and the context behind the request is opaque.
This exchange was subject to a fragmentation going on in the wider industry. In the fireside talk that immediately preceded the panel, Mastercard moved to the side of measuring intent by building an open-source framework to promote as a standard, because complex B2B purchases can’t work without that trust. In briefings with VentureBeat, endpoint security CTOs went the other way, saying they’d bet on probability instead of inferring intent for production workloads. Chang explained why models as trained today cannot reliably capture intent, so deterministic controls and behavioral proxies remain necessary. Ceylan accepted that both are needed. "Unless you’re doing something deterministic, you’re really relying a lot on intent, and I’ve yet to see programs that have" he said.
Ceylan’s story about the collapse of trust after a single agent error was the most memorable moment of the panel, because enterprise agent security is not a fixed and fixed problem. Models change, permissions shift, and adversaries adapt to multi-loop conversations that snapshot tests can never capture.
The panel’s offer was open to 82% of businesses that rely on the provider’s on-premise controls as their primary security layer and 59% of businesses shopping for agent security tools in the next 12 months. Check the attack method of attackers throughout the entire conversations and continuously, or find out what your single-turn red team is missing in production.
