PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection
A new preprint introduces PlanFlip, a framework of four planning-phase prompt injection attacks targeting multi-agent LLM systems. The attacks exploit the Planner agent to corrupt all downstream sub-tasks, with results showing that more capable models like GPT-5 are more vulnerable (attack success rate of 0.68), challenging the assumption that stronger models are inherently more secure. The authors also propose two defense mechanisms, GoalAnchorCheck and CrossAgentConsensus, which achieve detection rates up to 1.00 and outperform same-backbone baselines.
Why it matters: This work reveals a significant security vulnerability in multi-agent LLM systems, demonstrating that planning-phase prompt injection can compromise entire pipelines and that increased model capability may amplify risk.
Full story at: arXiv AI/ML ↗