PlanFlip attacks achieve 0.68 success rate on GPT-5

A new arXiv paper reveals that PlanFlip attacks achieve a 0.68 attack success rate on GPT-5, with homogeneous multi-agent pipelines using the same LLM backbone for planning and auditing being highly vulnerable. The attacks disguise malicious instructions as plausible tool outputs, and critics from GPT-4o and Llama-3.3-70B show perfect stealth, failing to detect hijacked plans. The authors recommend heterogeneous pipelines with different model backbones or reasoning-focused models like DeepSeek-R1 to prevent system-wide agent takeovers.

arXiv https://arxiv.org/abs/2607.16199 PlanFlip attacks achieve 0.68 success rate on GPT-5 Which summary reads better? Pick one — models revealed after.Both summaries are AI-generated. A single prompt injection into your Planner agent's context—disguised as a tool output to slip past keyword filters—cascades into every downstream sub-task at once, and stronger models are more exploitable, not less GPT-5 hit a 0.68 attack success rate . Critically, using the same backbone model for your Critic gives zero protection: the Critic silently rubber-stamps corrupted plans stealth 1.00 , so redundancy within one model family is security theater. If you run multi-agent pipelines, deliberately diversify your Planner/Critic across model families and add goal-anchoring and cross-agent consensus checks, since planning-phase injection is a distinct surface your executor-level guardrails won't catch. Homogeneous multi-agent pipelines using the same LLM backbone for both planning and auditing are highly vulnerable to cascading prompt injections, with GPT-4o and Llama-3.3-70B critics registering perfect stealth and completely failing to detect hijacked plans. This security vulnerability actually scales with model capability, reaching an attack success rate of 0.68 on GPT-5 by disguising malicious instructions as plausible tool outputs. To prevent stealthy, system-wide agent takeovers in production, you must design heterogeneous pipelines using different model backbones for planners and critics, or deploy reasoning-focused models like DeepSeek-R1 which show total resistance to these planning-phase attacks.