GPT-5.4 moves from 2.74% single-turn ASR to 24.68% multi-turn ASR, a 9x increase.

Nova 2 Lite shows 34.05% single-turn ASR but 7.89% multi-turn ASR.

Anthropic Claude-family single-turn ASR ranges from 2.19% to 3.64%, and multi-turn ASR ranges from 11.16% to 16.20%.

Grok 4.1 Fast in its non-reasoning configuration records a multi-turn ASR of 88.30%.

In an earlier open-weight evaluation, multi-turn ASR reached 92.78% against Mistral Large-2.

Multi-turn attack success rate (ASR) ranges from 7.89% to 88.30% across the 15 closed/proprietary flagship models in the cohort.

Single-turn attack success rate (ASR) ranges from 2.19% to 64.91% across the 15 closed/proprietary flagship models in the cohort.

Gemini 3 Pro shifts from 18.10% single-turn ASR to 73.35% multi-turn ASR, a 4x increase.

Cross-regime deltas (multi-turn ASR minus single-turn ASR) range from −34.74 percentage points to +55.25 percentage points across the cohort.

17% of prompts include copy/paste and/or file upload activity.

Among the most active chat tools observed, OpenAI accounts for 67% of prompt volume.

Detected sensitive-data events are led by secrets and credentials (47.9%), followed by financial information (36.3%) and health-related data (15.8%).

OpenAI is present in 96.0% of organizations, with Anthropic present in 77.8% of organizations.