{"slug": "planflip-attacks-achieve-0-68-success-rate-on-gpt-5", "title": "PlanFlip attacks achieve 0.68 success rate on GPT-5", "summary": "A new arXiv paper reveals that PlanFlip attacks achieve a 0.68 attack success rate on GPT-5, with homogeneous multi-agent pipelines using the same LLM backbone for planning and auditing being highly vulnerable. The attacks disguise malicious instructions as plausible tool outputs, and critics from GPT-4o and Llama-3.3-70B show perfect stealth, failing to detect hijacked plans. The authors recommend heterogeneous pipelines with different model backbones or reasoning-focused models like DeepSeek-R1 to prevent system-wide agent takeovers.", "body_md": "[arXiv](https://arxiv.org/abs/2607.16199)\n\n### PlanFlip attacks achieve 0.68 success rate on GPT-5\n\nWhich summary reads better? Pick one — models revealed after.Both summaries are AI-generated.\n\nA single prompt injection into your Planner agent's context—disguised as a tool output to slip past keyword filters—cascades into every downstream sub-task at once, and stronger models are more exploitable, not less (GPT-5 hit a 0.68 attack success rate). Critically, using the same backbone model for your Critic gives zero protection: the Critic silently rubber-stamps corrupted plans (stealth 1.00), so redundancy within one model family is security theater. If you run multi-agent pipelines, deliberately diversify your Planner/Critic across model families and add goal-anchoring and cross-agent consensus checks, since planning-phase injection is a distinct surface your executor-level guardrails won't catch.\n\nHomogeneous multi-agent pipelines using the same LLM backbone for both planning and auditing are highly vulnerable to cascading prompt injections, with GPT-4o and Llama-3.3-70B critics registering perfect stealth and completely failing to detect hijacked plans. This security vulnerability actually scales with model capability, reaching an attack success rate of 0.68 on GPT-5 by disguising malicious instructions as plausible tool outputs. To prevent stealthy, system-wide agent takeovers in production, you must design heterogeneous pipelines using different model backbones for planners and critics, or deploy reasoning-focused models like DeepSeek-R1 which show total resistance to these planning-phase attacks.", "url": "https://wpnews.pro/news/planflip-attacks-achieve-0-68-success-rate-on-gpt-5", "canonical_source": "https://www.snipvote.com/story/cmrubpmb2000ahtef5earpm3o", "published_at": "2026-07-21 07:53:40.061702+00:00", "updated_at": "2026-07-21 07:53:42.035273+00:00", "lang": "en", "topics": ["ai-safety", "large-language-models", "ai-agents", "ai-research"], "entities": ["OpenAI", "GPT-5", "GPT-4o", "Llama-3.3-70B", "DeepSeek-R1", "arXiv"], "alternates": {"html": "https://wpnews.pro/news/planflip-attacks-achieve-0-68-success-rate-on-gpt-5", "markdown": "https://wpnews.pro/news/planflip-attacks-achieve-0-68-success-rate-on-gpt-5.md", "text": "https://wpnews.pro/news/planflip-attacks-achieve-0-68-success-rate-on-gpt-5.txt", "jsonld": "https://wpnews.pro/news/planflip-attacks-achieve-0-68-success-rate-on-gpt-5.jsonld"}}