How LLM jailbreaking can bypass AI security with multi-turn attacks

### Executive Summary This report analyzes multi-turn LLM jailbreaking (the "Crescendo" method), where attackers distribute malicious intent across several conversational turns or via an automated agent to evade single-message moderation. It demonstrates the attack progression with a ZephyrBank reputational example, outlines an automated adversarial loop (probe, backtrack, escalate), and recommends conversation-aware testing, constrained conversation lengths, and continuous adversarial red-teaming to detect and mitigate these risks.