{
  "id": 17532091,
  "title": "Multi-Turn Jailbreaks Against AI Agents With Tool Access",
  "url": "https://urgent.news/2026/11/01/multi-turn-jailbreaks-against-ai-agents-with-tool-access",
  "topic": "ai",
  "section": "AI",
  "published": "2026-11-01T04:30:12.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/robat_das_3c6e956212f6408/multi-turn-jailbreaks-against-ai-agents-with-tool-access-5f0c"
  },
  "original_language": "en",
  "account": "A multi-turn jailbreak on an AI agent can bypass its guardrails by spreading the attack over several turns, as each message is evaluated independently. This makes it difficult for refusals and per-message filters to catch the malicious intent. The attacker gradually escalates the request, starting with benign queries and escalating using the model's own earlier replies. Automated jailbreaks like Crescendo have demonstrated higher success rates compared to other state-of-the-art methods on AI models like GPT-4 and Gemini-Pro.\n\nThe issue lies in the fact that the refusal to perform an action takes place within the model, while the actual tool call is outside the model's scope. This means that even if the model refuses a request, the tool call can still proceed, allowing the attacker to carry out the malicious action. The usual failure is that the rule exists only as text in the conversation, which can be challenged by the model.\n\nIn practice, a rule in the prompt is not a permission; the refusal lives in the model, and the damage occurs at the tool call. To prevent multi-turn jailbreaks, the permission check must be enforced in code at the tool boundary, outside the model's influence. This involves checking the tool, environment, and a flag that cannot be altered by the conversation.\n\nFor example, when interacting with a database, different actions may have varying restrictions based on the environment and policy. The authorization function should verify the tool, arguments, and grants, raising a PermissionError if the action is not allowed in the current environment or if the policy requires a break-glass flag. By implementing this permission check, the system can better protect against multi-turn jailbreaks that rely on the model's refusal to perform the action.",
  "summary": "Originally published on robatdasorvi.com The defense against a multi-turn jailbreak on an AI agent is to stop the tool call, not the conversation. Refusals and per-message filters miss attacks spread over several turns, because each turn looks harmless on its own. Enforce permissions in code, outside the model, on every action the agent takes. I built and ran an X growth agent where every post,…",
  "key_points": [
    "Multi-turn jailbreaks bypass AI guardrails by spreading attacks over several turns.",
    "Refusal occurs within model, while tool call happens outside model's scope.",
    "Prevent by enforcing permission check in code at tool boundary, outside model's influence."
  ],
  "editors_take": "Spreading malicious intent across multiple turns exploits the gap between a model's internal refusals and the external execution of tool calls, necessitating security enforcement at the code level.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}