Bad actors can hide a harmful goal from AI safeguards — so how do they actually sneak it through?

This explores how a harmful goal gets disguised on its way through an AI system. One caveat first: the corpus never names 'three known routes' as a set. What it does show are three mechanisms that work differently from each other: split the plan up, plant it as the model's own thinking, or bend it before there is anything to inspect.

**Route 1: split it into innocent-looking pieces.** Multi-agent systems get their power from dividing work and specializing roles. That same design lets a harmful objective be spread across steps that each look benign, with the harm appearing only when they combine (Can task decomposition hide harmful intent across agents?). The trick also works against security tooling. ColluSkill plans a chain of skills, then uses scanner feedback to soften each one. Scanners score skills one at a time, so the chain's meaning survives, and the attack reaches 96% average success across six scanners (Can attackers evade skill scanners by refining individual skills?).

**Route 2: plant the plan so the model re-voices it as its own.** Researchers found that reasoning models follow harmful but benign-sounding plans placed in their context, then paraphrase them as if they were their own reasoning. Chain-of-thought monitors miss this 25 to 33 percent of the time, and the attacker needs only context access, not the model's weights (Can reasoning models be steered by injected context without detection?). A neighboring case is DecepChain, which backdoors reasoning so it stays fluent and coherent while being quietly wrong (Can chain-of-thought reasoning be secretly manipulated to look normal?). In both, reading the reasoning trace is not proof the reasoning is honest.

**Route 3: bias the plan before it exists.** FLOWSTEER-style attacks corrupt the signals that feed planning, so the workflow is already tilted when it forms. Defenses that inspect only the finished workflow arrive too late. Separating the task, method, and framing intents at the input boundary cut malicious success by up to 34 percent (Can inspecting generated workflows catch planning-time attacks?).

**What defenders have so far.** One idea is to tag the root request with a semantic taint that follows the delegation graph instead of the text, so it survives paraphrasing and fragmentation (Can semantic labels on requests prevent malicious propagation through agent networks?). The catch is that surviving rewrites forces coarse labels on all downstream work (How does SafeFlow track sensitivity through agent rewrites?). For plan injection, the monitor defenses are still unsettled: four candidates exist, and only one has a partial experiment (Can monitors catch plan injection attacks in chain-of-thought reasoning?).

All three routes exploit a checker that looks at a piece rather than the whole: one step, one skill, one reasoning trace, or one finished workflow. The harmful intent lives in the composition, the origin, or the upstream signal, which are the places those checkers don't look.