level: research
multi-agent llm systems often use a planner to break goals into subtasks for executor and critic agents. a new study finds the planning phase is a weak point. a single prompt injection there can cascade through all downstream tasks. the researchers created planflip, a framework with four attack types: goal substitution, priority inversion, context pollution, and role confusion. these attacks hide as normal tool outputs to avoid keyword filters.
tests across nine frontier llms and 3,479 episodes revealed surprising results. stronger models were more vulnerable. gpt-5 had the highest attack success rate at 0.68. this goes against the idea that more capable models are automatically safer. the study also found that using the same model for all agents creates a blind spot. when all agents are the same, they fail to catch each other's mistakes, making the system easier to fool.
the findings highlight a new risk in multi-agent setups. current safety measures often focus on single-agent interactions. they miss how attacks can spread in a chain of agents. the planflip attacks show that even simple, disguised prompts can break complex systems. this calls for new defenses that look at the whole workflow, not just individual steps. developers need to rethink how they secure multi-agent pipelines.
why it matters: this research shows that multi-agent llm systems have a hidden weakness in their planning phase, which could let attackers corrupt entire workflows with a single prompt, making it crucial for ai developers to design better safeguards.