A model that refuses once may not refuse again. We introduce MAZE (Multi-turn Adversarial Zone Exploration), a black-box jailbreak framework that adapts its prompts to the target model’s responses across a dialogue. Across ten state-of-the-art models, MAZE achieves 50% attack success on commercial systems and 74% on open-source systems, with the highest observed average ASR and average rank among evaluated baselines. Ablations show that accumulated conversational context is the primary driver: removing target-side history reduces ASR by 32.9% on open-source models and 56.1% on commercial models, revealing strongly path-dependent safety behaviour. When refusals occur, adaptive recovery helps restore conversational progress through reframing. We identify three recurring interaction patterns: legitimacy construction, context-dependent risk calibration, and helpfulness–safety tension, that help explain why follow-up requests can receive different safety treatment from isolated requests. Claude-Sonnet-4.5 is a notable exception, maintaining refusals across most reframing attempts. These findings motivate evaluating alignment across full multi-turn trajectories rather than at the point of initial refusal.