Cisco AI cuts report drafting 50%, leaks data across cases

Cisco Talos ran a controlled experiment using AI to draft security incident response reports and found a 50% reduction in drafting time, with output quality good enough to pass blind human review. That sounds like a win, but the test also surfaced a serious architectural flaw that overshadowed the efficiency gains. The problem was session-level contamination: when multiple incident reports were opened within the same context window, the AI pulled details from one case into another. Irrelevant indicators of compromise, duplicated remediation recommendations, and misattributed findings bled across unrelated incidents. In security reporting, that kind of cross-contamination isn't a minor formatting error. It can misdirect response teams and corrupt the evidentiary record of an investigation. Essentially: Cisco Talos discovered that LLM context management, not output quality, is the load-bearing risk in enterprise security workflows. - AI drafts passed human blind review on quality, but reviewers were not testing for cross-report contamination specifically. - The contamination occurred at the session level, meaning standard prompt engineering alone would not prevent it without strict context isolation per incident. - Cisco published the finding as a cautionary deployment case, explicitly stating human authors must retain ownership of every word produced. The broader implication is that AI performance benchmarks measured in isolation consistently miss failure modes that only appear under realistic multi-task, multi-session enterprise conditions.