Researchers at Stanford University and Carnegie Mellon University found that an AI agent can adopt a harmful plan from its context while showing another model a reasoning trace that appears ordinary. In two benchmark families, five monitors built from current language models missed at least 25% of attacks that successfully changed the agent's behavior. The plan-injection study was posted as an unreviewed preprint on September 14.
An AI agent may receive a plan from a search system, software tool or another agent before it acts. A reasoning monitor is a separate model that reads the agent's visible chain of thought and assigns a suspicion score. The defence works only when the unsafe intention remains visible. Plan injection instead places a plausible but faulty sequence in the agent's context, allowing the agent to paraphrase and follow it without clearly revealing where it came from.
The researchers began with a valid solution, asked another model to rewrite it around a concealed failure and supplied the altered plan to the acting model as optional guidance. The actor could follow that plan or solve the task independently. A monitor then reviewed the resulting transcript. In one setting it saw only the actor's reasoning; in another it also received the injected plan.
The main tests used 550 programming problems and a combined biology-and-mathematics benchmark. Qwen3-8B and DeepSeek-R1-0528 served as the acting models. Five monitors, including GPT-4o Mini, Claude 3.7 Sonnet and larger reasoning models, judged the transcripts. The researchers first measured whether the injection changed a correct solution, then tested monitors only on attacks that had succeeded.
Depending on the actor and benchmark, the best of three injection attempts changed the solution in 41.7% to 98.9% of tasks. Even the strongest monitoring settings missed at least one successful attack in four. Giving a monitor more reasoning tokens did not improve its decisions consistently. The failure therefore remained after the monitor received more time to inspect the trace.
The study covers benchmark prompts and two open-weight actors rather than complete retrieval or multi-agent products. Closed models were tested only for whether they followed a plan because their reasoning traces were unavailable. Production evaluations now need to record where imported plans came from, expose monitors to attack styles they have not seen and compare the warning with the action the agent finally takes.
Sources
- Keertana Chidambaram, Andrew Ilyas and Vasilis Syrgkanis, “Corrupt Plans, Clean Traces,” arXiv, September 14, 2026. Abstract, authorship, submission date and headline result.
- Full paper. Attack sequence, datasets, models, thresholds, results and limitations.
- Lead image: J. Chiles/NIST, public information from the U.S. National Institute of Standards and Technology; credit retained under NIST's reuse guidance. The image is illustrative and does not depict the plan-injection study.