PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection

A new study from arXiv reveals that multi-agent LLM systems are vulnerable to planning-phase prompt injection attacks, with GPT-5 achieving the highest attack success rate (ASR = 0.68) across 3,479 episodes, contradicting the assumption that stronger models are more secure. The PlanFlip framework introduces four attack types—GoalSubstitution, PriorityInversion, ContextPollution, and RoleConfusion—that exploit the Planner agent to corrupt all downstream sub-tasks. The researchers propose GoalAnchorCheck and CrossAgentConsensus defenses, achieving detection rates up to 1.00, and conclude that heterogeneous model diversity is a security prerequisite for multi-agent systems.

arXiv:2607.16199v1 Announce Type: new Abstract: Multi-agent LLM systems increasingly rely on a Planner to decompose goals into sub-task sequences that downstream Executor and Critic agents execute and audit. We identify the planning phase as a critical attack surface: a single injection into the Planner's context achieves cascade amplification, corrupting all downstream sub-tasks simultaneously. We introduce PlanFlip, a framework comprising four planning-phase prompt injection attacks -- GoalSubstitution PF-1 , PriorityInversion PF-2 , ContextPollution PF-3 , and RoleConfusion PF-4 -- each disguised as plausible tool outputs to evade keyword filters. Evaluating nine frontier LLMs across 3,479 episodes, we uncover three findings: 1 capability amplifies vulnerability -- GPT-5 achieves the highest attack success rate ASR = 0.68 , contradicting the assumption that stronger models are inherently more secure; 2 homogeneous pipelines exhibit a correlated-agent blind spot -- GPT-4o and Llama-3.3-70B show ASR near 0 yet Stealth = 1.00 and StepShift 0, with attacks restructuring plans while the same-backbone Critic reports alignment two independent judges confirm -0.20 to -0.32 semantic deviation, r = 0.943 ; 3 reasoning-augmented models resist injections -- DeepSeek-R1 achieves StepShift = 0.00 across all attacks. We propose GoalAnchorCheck D1 and CrossAgentConsensus D2 , achieving detection rates up to 1.00 and outperforming same-backbone baselines in 15 of 16 cells. Our key insight: heterogeneous model diversity is a security prerequisite for multi-agent systems; redundancy within a homogeneous backbone provides no protection against planning-phase attacks.