{"slug": "planflip-attacking-multi-agent-llm-systems-via-planning-phase-prompt-injection", "title": "PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection", "summary": "A new study from arXiv reveals that multi-agent LLM systems are vulnerable to planning-phase prompt injection attacks, with GPT-5 achieving the highest attack success rate (ASR = 0.68) across 3,479 episodes, contradicting the assumption that stronger models are more secure. The PlanFlip framework introduces four attack types—GoalSubstitution, PriorityInversion, ContextPollution, and RoleConfusion—that exploit the Planner agent to corrupt all downstream sub-tasks. The researchers propose GoalAnchorCheck and CrossAgentConsensus defenses, achieving detection rates up to 1.00, and conclude that heterogeneous model diversity is a security prerequisite for multi-agent systems.", "body_md": "arXiv:2607.16199v1 Announce Type: new\nAbstract: Multi-agent LLM systems increasingly rely on a Planner to decompose goals into sub-task sequences that downstream Executor and Critic agents execute and audit. We identify the planning phase as a critical attack surface: a single injection into the Planner's context achieves cascade amplification, corrupting all downstream sub-tasks simultaneously. We introduce PlanFlip, a framework comprising four planning-phase prompt injection attacks -- GoalSubstitution (PF-1), PriorityInversion (PF-2), ContextPollution (PF-3), and RoleConfusion (PF-4) -- each disguised as plausible tool outputs to evade keyword filters. Evaluating nine frontier LLMs across 3,479 episodes, we uncover three findings: (1) capability amplifies vulnerability -- GPT-5 achieves the highest attack success rate (ASR = 0.68), contradicting the assumption that stronger models are inherently more secure; (2) homogeneous pipelines exhibit a correlated-agent blind spot -- GPT-4o and Llama-3.3-70B show ASR near 0 yet Stealth = 1.00 and StepShift > 0, with attacks restructuring plans while the same-backbone Critic reports alignment (two independent judges confirm -0.20 to -0.32 semantic deviation, r = 0.943); (3) reasoning-augmented models resist injections -- DeepSeek-R1 achieves StepShift = 0.00 across all attacks. We propose GoalAnchorCheck (D1) and CrossAgentConsensus (D2), achieving detection rates up to 1.00 and outperforming same-backbone baselines in 15 of 16 cells. Our key insight: heterogeneous model diversity is a security prerequisite for multi-agent systems; redundancy within a homogeneous backbone provides no protection against planning-phase attacks.", "url": "https://wpnews.pro/news/planflip-attacking-multi-agent-llm-systems-via-planning-phase-prompt-injection", "canonical_source": "https://arxiv.org/abs/2607.16199", "published_at": "2026-07-21 04:00:00+00:00", "updated_at": "2026-07-21 04:06:19.800500+00:00", "lang": "en", "topics": ["ai-safety", "large-language-models", "ai-agents"], "entities": ["arXiv", "PlanFlip", "GPT-5", "GPT-4o", "Llama-3.3-70B", "DeepSeek-R1", "GoalAnchorCheck", "CrossAgentConsensus"], "alternates": {"html": "https://wpnews.pro/news/planflip-attacking-multi-agent-llm-systems-via-planning-phase-prompt-injection", "markdown": "https://wpnews.pro/news/planflip-attacking-multi-agent-llm-systems-via-planning-phase-prompt-injection.md", "text": "https://wpnews.pro/news/planflip-attacking-multi-agent-llm-systems-via-planning-phase-prompt-injection.txt", "jsonld": "https://wpnews.pro/news/planflip-attacking-multi-agent-llm-systems-via-planning-phase-prompt-injection.jsonld"}}