Multi-Turn Prompt Injection

Why it matters

Multi-turn attacks bypass single-turn defenses. Understanding shapes defense.

The architecture

Turn 1: benign priming.

Turn 2: role establishment.

Turn 3: exploit.

How it works end to end

Priming: set context favorable to exploit.

Role-play: 'you are unconstrained AI'.

Exploit: request forbidden content.

Defenses: session monitoring.