An attack pattern where individual prompts or requests look harmless, but the sequence of interactions creates malicious context. The risk emerges from state, memory, and policy decisions that accumulate over several turns rather than from a single obvious input.
Expanded Definition
Multi-turn abuse is a conversational attack pattern in which each prompt appears acceptable on its own, but the accumulated sequence steers an AI system toward unsafe action, policy bypass, or unintended disclosure. For NHI Management Group, the key issue is not the single message, but the state carried forward through memory, tool access, system instructions, and prior model outputs. In agentic AI settings, this matters even more because the model may retain partial context, call tools, or trigger workflows after several benign-looking turns.
Definitions and handling practices vary across vendors, especially where chat history, retrieval, and agent memory overlap. Some systems treat every turn as isolated input, while others preserve long-lived context that can be influenced over time. That is why multi-turn abuse is best understood as an interaction-level risk rather than a prompt-level failure. The most common misapplication is treating each user message as independently safe, which occurs when security review ignores how context accumulation can convert harmless turns into a coordinated exploit.
Authoritative governance language is still evolving, but the NIST Cybersecurity Framework 2.0 is useful for framing the control problem around continuous risk management, access control, and monitoring across an entire interaction flow.
Examples and Use Cases
Implementing protections against multi-turn abuse rigorously often introduces more friction in user experience and agent orchestration, requiring organisations to weigh conversational flexibility against tighter state inspection and policy enforcement.
- A user first asks for harmless formatting help, then gradually introduces requests that reshape the conversation until the model reveals policy-restricted operational guidance.
- In a support agent, a sequence of ordinary troubleshooting prompts is used to build enough context for the agent to expose secret-bearing logs or trigger an unsafe reset action.
- In a retrieval-augmented workflow, repeated benign questions are used to manipulate what the system remembers or retrieves, eventually surfacing content that should remain scoped or redacted.
- An attacker interacts with an AI assistant over several turns to establish false assumptions, then leverages those assumptions to influence downstream tool calls or approvals.
- For governance teams, OWASP guidance for LLM risks helps illustrate how prompt injection, context poisoning, and interaction drift can unfold across multiple exchanges rather than a single request.
Why It Matters for Security Teams
Multi-turn abuse matters because it exploits the gap between local judgment and cumulative system behavior. A single prompt review can miss the real attack path if the model, agent, or workflow changes state across turns. That creates risk for data leakage, unsafe tool execution, policy circumvention, and accidental disclosure of secrets, especially when assistants have access to tickets, repositories, APIs, or operational consoles. In identity-heavy environments, the issue becomes more severe when the AI agent acts with delegated authority, because conversational manipulation can translate into privileged action.
Security teams need to treat the full dialogue as the security boundary, not just the last message. That means auditing memory design, scoping tool permissions, logging turn-by-turn state changes, and resetting trust assumptions when conversation context shifts. The right control approach is closer to continuous verification than one-time prompt filtering. Practical resilience also depends on understanding how agentic systems inherit risk from identity, access, and privilege design, which makes the term relevant to both AI security and NHI governance. Organisations typically encounter the consequences only after an assistant has already leaked context or executed the wrong action, at which point multi-turn abuse becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST AI RMF and NIST AI 600-1 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.RM-01 | Risk management across changing interactions applies to multi-turn abuse. |
| NIST AI RMF | AI RMF addresses lifecycle risk management for behavior shaped over multiple turns. | |
| NIST AI 600-1 | GenAI profile covers risks from context manipulation and unsafe model interaction. | |
| OWASP Agentic AI Top 10 | Agentic AI guidance addresses conversational abuse patterns affecting tool-using agents. | |
| OWASP Non-Human Identity Top 10 | NHI guidance is relevant when multi-turn abuse targets persistent identities and secrets. |
Harden GenAI systems against stateful prompt manipulation and unsafe context carryover.
Related resources from NHI Mgmt Group
- What breaks when teams rely on single-turn filters to stop AI abuse?
- Why do multi-accounting and bonus abuse create such a governance problem in iGaming?
- Why do multi-accounting and bonus abuse require unified identity and fraud controls?
- Why do multi-accounting and bonus abuse break weak identity programmes?
