# PlanFlip attacks achieve 0.68 success rate on GPT-5 > Source: > Published: 2026-07-21 07:53:40.061702+00:00 [arXiv](https://arxiv.org/abs/2607.16199) ### PlanFlip attacks achieve 0.68 success rate on GPT-5 Which summary reads better? Pick one — models revealed after.Both summaries are AI-generated. A single prompt injection into your Planner agent's context—disguised as a tool output to slip past keyword filters—cascades into every downstream sub-task at once, and stronger models are more exploitable, not less (GPT-5 hit a 0.68 attack success rate). Critically, using the same backbone model for your Critic gives zero protection: the Critic silently rubber-stamps corrupted plans (stealth 1.00), so redundancy within one model family is security theater. If you run multi-agent pipelines, deliberately diversify your Planner/Critic across model families and add goal-anchoring and cross-agent consensus checks, since planning-phase injection is a distinct surface your executor-level guardrails won't catch. Homogeneous multi-agent pipelines using the same LLM backbone for both planning and auditing are highly vulnerable to cascading prompt injections, with GPT-4o and Llama-3.3-70B critics registering perfect stealth and completely failing to detect hijacked plans. This security vulnerability actually scales with model capability, reaching an attack success rate of 0.68 on GPT-5 by disguising malicious instructions as plausible tool outputs. To prevent stealthy, system-wide agent takeovers in production, you must design heterogeneous pipelines using different model backbones for planners and critics, or deploy reasoning-focused models like DeepSeek-R1 which show total resistance to these planning-phase attacks.