Top three-source viewpoints and TSO verification findings:
Source 1 says Cisco researchers warned that if users guide an LLM into a “multi-branch, persistent” multi-turn conversation, the safety guardrails of some well-known models may be bypassed; models named include ChatGPT, Claude, Gemini, Amazon Nova and xAI’s Grok.
Source 2 states that Cisco’s latest research shows frontier models from OpenAI, Anthropic, Google, xAI and Amazon have a markedly worse risk profile under multi-turn attack pressure than in single-prompt benchmark tests.
Source 3 adds that evasion tactics in multi-turn conversations include role-play-style persona setting, ambiguity and misdirection around context, and rephrasing requests after an initial refusal.
TSO verification conclusion: the three sources are aligned on the core fact that mainstream LLMs can have their security defenses weakened through multi-turn iterative manipulation; descriptions of specific models, attack methods and configuration differences are complementary rather than contradictory. However, some details are mentioned by only one source, so they should be marked as “not mentioned in the source” or “cannot be confirmed from the provided sources.”
Commonly confirmed facts:
Cisco researchers published a study on large language model security.
Multi-turn, iterative conversational attacks are more likely than single prompts to expose model risk.
The vendors/models involved include OpenAI, Anthropic, Google, Amazon and xAI-related models.
The study indicates that safety guardrails may be bypassed under certain multi-turn manipulations.
Source 3 explicitly lists some manipulation methods: role-playing, contextual misdirection, and rephrasing a request after an initial refusal.
Main differences or points of divergence:
The model lists differ slightly in wording:
Source 1 explicitly mentions ChatGPT, Claude, Gemini, Amazon Nova and Grok.
Source 2 refers to frontier models from OpenAI, Anthropic, Google, xAI and Amazon at the vendor level.
These descriptions do not conflict, but they differ in granularity.
Regarding “Grok’s reasoning mode”:
The premise summary mentions that behavior may vary by configuration, such as Grok’s reasoning mode.
However, none of the three provided sources directly mentions “reasoning mode” or specific configuration differences, so this cannot be confirmed from the provided sources.
Regarding the level of quantification of the attack’s impact:
Source 2 says the risk profile is “significantly worse,” but provides no specific numbers.
The provided sources do not include complete quantified results, so the exact magnitude cannot be confirmed from the sources.
Regarding the absolute claim that “major LLMs can all be bypassed”:
Source 1 uses the wording “several prominent large language models can be bypassed.”
Source 2 says “frontier models ... significantly worse risk profiles.”
The conclusions are aligned, but the wording strength differs, so it cannot be inferred that all models were completely bypassed.
Background and analysis:
Based on the provided sources, the focus of this research is not a single-prompt jailbreak, but gradual manipulation in multi-turn interactions. In other words, an attacker may weaken the model’s refusal behavior and safety judgment through sustained dialogue, contextual setup, and repeated request reformulation. The tactics listed in Source 3—role play, contextual ambiguity, and request rephrasing after refusal—suggest that such attacks work more like step-by-step conversational induction than a one-shot prompt.
It is important to note that the provided sources do not offer full methodological details, sample sizes, test conditions or performance under different configurations for each model. Therefore, it is not possible to infer a systematic weakness in any specific vendor’s model, nor to confirm the premise summary’s mention of Grok’s reasoning mode. The available information supports only a cautious conclusion: within Cisco’s testing framework, mainstream frontier LLMs performed worse in multi-turn attack environments than in single-turn baseline scenarios.
From an editorial perspective, the key point in this kind of report is not to exaggerate “the models were broken,” but to accurately distinguish between “bypassable under specific attack methods and test conditions” and “overall security failure.” On the currently provided sources, the latter cannot be established.
Three-source summary:
Source 1: Multi-turn, persistent conversations may bypass the safety guardrails of several mainstream LLMs, including ChatGPT, Claude, Gemini, Amazon Nova and Grok.
Source 2: Cisco’s research shows that frontier models from OpenAI, Anthropic, Google, xAI and Amazon have a higher risk under multi-turn attacks than under single-prompt benchmarks.
Source 3: Tactics that can bypass guardrails include role-playing, contextual misdirection and rephrasing a request after an initial refusal.
Conclusion:
Taken together, the three sources confirm that Cisco’s research found mainstream large language models may have their safety guardrails bypassed under multi-turn iterative manipulation. What remains unconfirmed are the more specific configuration differences mentioned in the premise, such as Grok’s reasoning mode, as well as any quantitative conclusions not explicitly stated in the sources.