Multi-turn reasoning models can maintain safe surface metrics while their internal states are compromised across conversation turns or their secure internal logic is ignored in harmful outputs.