PlanFlip attack exposes critical flaw in multi-agent LLM systems

A new paper from Yuhang Wang unveils PlanFlip, a framework that exploits multi-agent LLM systems by injecting malicious prompts during the planning phase. Unlike previous attacks that target individual agents, PlanFlip corrupts the Planner's context, causing cascade amplification across all downstream sub-tasks. The framework includes four attack types—GoalSubstitution, PriorityInversion, ContextPollution, and RoleConfusion—disguised as tool outputs to evade filters. Testing across nine frontier models and 3,479 episodes reveals counterintuitive findings: GPT-5, the most capable model, achieved the highest attack success rate (0.68), challenging the assumption that stronger models are more secure. Meanwhile, homogeneous pipelines like GPT-4o and Llama-3.3-70B showed near-zero ASR but exhibited a correlated-agent blind spot—attacks restructured plans while the same-backbone Critic reported alignment, with two judges confirming minimal semantic deviation (r=0.943). In contrast, reasoning-augmented models like DeepSeek-R1 achieved zero StepShift across all attacks, demonstrating robust resistance.

To counter these threats, Wang proposes two defenses: GoalAnchorCheck and CrossAgentConsensus, which achieved detection rates up to 1.00, outperforming same-backbone baselines in 15 of 16 test cases. The key insight is that heterogeneous model diversity is a security prerequisite for multi-agent systems; redundancy within a homogeneous backbone provides no protection against planning-phase attacks. For professionals building AI agent pipelines, this research underscores the urgent need to move beyond single-model architectures and implement diverse, reasoning-augmented components with cross-validation mechanisms to prevent catastrophic failures from a single injection point.