@@ -470,6 +470,9 @@ def __init__(
         self._prepended_history_send_context: PrependedHistorySendContext | None = None
         # Context from prepended conversation (for adversarial chat system prompt)
         self._conversation_context: str | None = None
+        # Number of prepended messages persisted in the objective target conversation. They are
+        # history, not attack turns, so they do not count when deciding whether this is the first turn.
+        self._prepended_message_count = 0
 
         # Initial prompt for first turn (bypasses adversarial chat generation)
         # This supports multimodal messages
@@ -529,6 +532,7 @@ async def initialize_with_prepended_conversation_async(
         persisted_messages = list(
             self._memory.get_conversation_messages(conversation_id=self.objective_target_conversation_id)
         )
+        self._prepended_message_count = len(persisted_messages)
         self._prepended_history_send_context = conversation_manager.create_prepended_history_send_context(
             target=self._objective_target,
             conversation_id=self.objective_target_conversation_id,
@@ -1021,6 +1025,7 @@ def duplicate(self) -> _TreeOfAttacksNode:
 
         # Copy conversation context for adversarial chat system prompt
         duplicate_node._conversation_context = self._conversation_context
+        duplicate_node._prepended_message_count = self._prepended_message_count
         duplicate_node.last_response = copy.deepcopy(self.last_response)
 
         # Copy visualization position so the clone starts from the same tree position
@@ -1210,14 +1215,15 @@ def _is_first_turn(self) -> bool:
         Check if this is the first turn of the conversation.
 
         This method determines whether the node is executing its initial attack turn by
-        examining the objective target conversation history.
+        examining the objective target conversation history. Prepended messages are history
+        rather than attack turns, so they are not counted.
 
         Returns:
-            bool: True if no messages exist in the objective target conversation (first turn),
-                False if the conversation already contains messages (subsequent turns).
+            bool: True if the objective target conversation contains no messages beyond the
+                prepended conversation (first turn), False otherwise (subsequent turns).
         """
         target_messages = self._memory.get_conversation_messages(conversation_id=self.objective_target_conversation_id)
-        return not target_messages
+        return len(target_messages) <= self._prepended_message_count
 
     async def _generate_first_turn_prompt_async(self, objective: str) -> str:
         """
 
@@ -0,0 +1,151 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+"""
+End-to-end coverage that TAP and PAIR still run their first attack turn when a prepended
+conversation is supplied. Prepended messages are persisted in the objective target
+conversation, but they are history rather than attack turns: the first live turn must still
+set the adversarial system prompt and honor ``next_message``.
+"""
+
+import json
+
+import pytest
+from unit.mocks import MockPromptTarget
+
+from pyrit.executor.attack import (
+    AttackAdversarialConfig,
+    AttackScoringConfig,
+    PAIRAttack,
+    TreeOfAttacksWithPruningAttack,
+)
+from pyrit.models import AttackOutcome, Message, MessagePiece, Score
+from pyrit.score import FloatScaleThresholdScorer
+from pyrit.score.float_scale.float_scale_scorer import MessageFloatScaleScorer
+from pyrit.score.scorer_prompt_validator import ScorerPromptValidator
+
+
+class _AdversarialTarget(MockPromptTarget):
+    """Adversarial chat that records its system prompts and replies with schema-valid JSON."""
+
+    def __init__(self) -> None:
+        super().__init__()
+        self.system_prompts: list[str] = []
+
+    def set_system_prompt(self, *, system_prompt: str, conversation_id: str, **kwargs) -> None:
+        self.system_prompts.append(system_prompt)
+        super().set_system_prompt(system_prompt=system_prompt, conversation_id=conversation_id, **kwargs)
+
+    async def _send_prompt_to_target_async(self, *, normalized_conversation: list[Message]) -> list[Message]:
+        message = normalized_conversation[-1]
+        self.prompt_sent.append(message.get_value())
+        reply = json.dumps(
+            {
+                "next_message": f"attack prompt {len(self.prompt_sent)}",
+                "rationale": "r",
+                "last_response_summary": "s",
+            }
+        )
+        return [
+            MessagePiece(
+                role="assistant", original_value=reply, conversation_id=message.message_pieces[0].conversation_id
+            ).to_message()
+        ]
+
+
+class _FixedFloatScorer(MessageFloatScaleScorer):
+    def __init__(self, *, value: str) -> None:
+        super().__init__(validator=ScorerPromptValidator(supported_data_types=["text"]))
+        self._value = value
+
+    def _build_identifier(self):
+        return self._create_identifier()
+
+    async def _score_piece_async(self, message_piece: MessagePiece, *, objective: str | None = None) -> list[Score]:
+        return [
+            Score(
+                score_value=self._value,
+                score_type="float_scale",
+                score_category=["test"],
+                score_rationale="rationale",
+                score_metadata=None,
+                message_piece_id=message_piece.id,
+                score_value_description="description",
+                scorer_class_identifier=self.get_identifier(),
+            )
+        ]
+
+
+def _build_attack(attack_cls, *, objective_target, adversarial_chat, score_value: str):
+    scorer = FloatScaleThresholdScorer(scorer=_FixedFloatScorer(value=score_value), threshold=0.7)
+    kwargs = (
+        {"branching_factor": 2, "on_topic_checking_enabled": False}
+        if attack_cls is TreeOfAttacksWithPruningAttack
+        else {}
+    )
+    return attack_cls(
+        objective_target=objective_target,
+        attack_adversarial_config=AttackAdversarialConfig(target=adversarial_chat),
+        attack_scoring_config=AttackScoringConfig(objective_scorer=scorer),
+        tree_width=2,
+        tree_depth=3,
+        **kwargs,
+    )
+
+
+@pytest.mark.parametrize("attack_cls", [TreeOfAttacksWithPruningAttack, PAIRAttack])
+async def test_system_only_prepended_conversation_still_attacks(attack_cls, sqlite_instance):
+    objective_target = MockPromptTarget()
+    adversarial_chat = _AdversarialTarget()
+    attack = _build_attack(
+        attack_cls, objective_target=objective_target, adversarial_chat=adversarial_chat, score_value="0.9"
+    )
+
+    result = await attack.execute_async(
+        objective="do X", prepended_conversation=[Message.from_system_prompt("You are a helpful assistant.")]
+    )
+
+    assert objective_target.prompt_sent, "no prompt reached the objective target"
+    assert adversarial_chat.system_prompts, "the adversarial system prompt was never set"
+    assert result.outcome == AttackOutcome.SUCCESS
+
+
+@pytest.mark.parametrize("attack_cls", [TreeOfAttacksWithPruningAttack, PAIRAttack])
+async def test_prepended_conversation_sets_adversarial_system_prompt_with_context(attack_cls, sqlite_instance):
+    objective_target = MockPromptTarget()
+    adversarial_chat = _AdversarialTarget()
+    attack = _build_attack(
+        attack_cls, objective_target=objective_target, adversarial_chat=adversarial_chat, score_value="0.1"
+    )
+    prepended = [
+        Message.from_prompt(prompt="PRIOR-USER-TURN", role="user"),
+        Message.from_prompt(prompt="PRIOR-ASSISTANT-TURN", role="assistant"),
+    ]
+
+    await attack.execute_async(objective="do X", prepended_conversation=prepended)
+
+    assert adversarial_chat.system_prompts
+    assert all("PRIOR-ASSISTANT-TURN" in system_prompt for system_prompt in adversarial_chat.system_prompts)
+
+
+async def test_prepended_conversation_sends_next_message_first(sqlite_instance):
+    objective_target = MockPromptTarget()
+    adversarial_chat = _AdversarialTarget()
+    attack = _build_attack(
+        TreeOfAttacksWithPruningAttack,
+        objective_target=objective_target,
+        adversarial_chat=adversarial_chat,
+        score_value="0.1",
+    )
+    prepended = [
+        Message.from_prompt(prompt="PRIOR-USER-TURN", role="user"),
+        Message.from_prompt(prompt="PRIOR-ASSISTANT-TURN", role="assistant"),
+    ]
+
+    await attack.execute_async(
+        objective="do X",
+        prepended_conversation=prepended,
+        next_message=Message.from_prompt(prompt="MY-CUSTOM-FIRST-PROMPT", role="user"),
+    )
+
+    assert objective_target.prompt_sent[0] == "MY-CUSTOM-FIRST-PROMPT"
@@ -946,13 +946,13 @@ async def test_tap_attack_adds_prepended_to_memory(
             next_message=multimodal_text_message,  # Required when prepended_conversation is provided
         )
 
-        # TAP prunes all branches with these mocks, so result.conversation_id is empty. The prepended
-        # messages were duplicated into the single node conversation; resolve that id from memory.
-        assert not result.conversation_id
+        # next_message is sent on the first live turn and scored as a success, so the result points at
+        # the single node conversation that holds the prepended messages.
+        assert result.conversation_id
         memory = CentralMemory.get_memory_instance()
         node_conversation_ids = {piece.conversation_id for piece in memory.get_message_pieces()}
-        assert len(node_conversation_ids) == 1, f"Expected one conversation in memory, got {node_conversation_ids}"
-        conversation = list(memory.get_conversation_messages(conversation_id=node_conversation_ids.pop()))
+        assert node_conversation_ids == {result.conversation_id}
+        conversation = list(memory.get_conversation_messages(conversation_id=result.conversation_id))
 
         # Should have exactly the prepended messages in memory (mock normalizer doesn't add responses)
         assert len(conversation) == 2, f"Expected exactly 2 prepended messages, got {len(conversation)}"