This post is also available in:
עברית (Hebrew)
AI assistants are rapidly evolving from chatbots that simply answer questions into autonomous agents capable of browsing websites, using software tools, sending emails and carrying out multi-step tasks. That makes them considerably more useful, but it also raises the stakes when their safety mechanisms fail. An agent persuaded to ignore its restrictions may be able to take real actions rather than merely generate problematic text.
Most AI safety evaluations test a relatively simple scenario: give the model one clearly harmful instruction and see whether it refuses. Researchers at EPFL have found that this approach can miss an important weakness. An attacker may have considerably more success by dividing the same objective into a sequence of requests that appear harmless when viewed individually.
To study the problem, researchers developed STING, short for Sequential Testing of Illicit N-step Goal execution. The automated framework behaves like a persistent attacker, creating a multi-stage strategy and adapting its requests as the conversation with the target AI agent develops.
Instead of immediately asking an agent to perform a prohibited action, it breaks the objective into smaller tasks. Each interaction establishes information or completes an action needed for the next stage, gradually moving the agent toward the attacker’s actual goal without presenting the entire malicious objective at once.
The researchers evaluated the technique across 176 harmful scenarios using several leading large language models operating as agents with access to external tools. Multi-turn manipulation consistently proved more effective than conventional single-prompt attacks. For some models, the probability of completing a harmful task was approximately twice as high when the objective was introduced gradually.
According to TechXplore, it also measures how quickly an attack succeeds, allowing researchers to compare different manipulation strategies rather than simply recording whether an agent eventually failed.
Language provided another unexpected result. The team tested attacks across seven languages, expecting lower-resource languages to produce weaker safety protections. Overall harmful task-completion rates were instead relatively similar. However, attacks that switched languages between different stages could sometimes become substantially more effective.
The findings have particular relevance for cybersecurity, defense and critical infrastructure. AI agents are increasingly being considered for tasks such as network administration, intelligence analysis and automated operational workflows. If such an agent has permission to interact with real systems, a successful social-engineering-style attack could potentially misuse those legitimate capabilities without exploiting conventional software vulnerabilities.
It is intended as a testing framework rather than an attack product. Its purpose is to help developers evaluate a threat that single-prompt safety benchmarks may overlook.
The research highlights a fundamental change in AI security. The question is no longer simply whether a model refuses an obviously dangerous command. Developers must also determine whether an agent can recognize that a long sequence of apparently reasonable requests is quietly leading toward the same prohibited outcome.
The research was published here.
