A Cisco-linked study on multi-turn attacks suggests that some frontier models can look safer in one-shot tests than they do when an attacker keeps the conversation going.