If someone tampers with an AI's plan before it's handed off, the next agent just follows it, and nobody notices.

This explores what goes wrong when the signals that shape an agent's plan are tampered with before a downstream agent acts on them. The corpus's answer is that the downstream agent behaves correctly. It follows a plan that looks legitimate, and the damage was done earlier, where nobody was checking.

The clearest case is a planner-executor system, where one agent drafts a workflow and others carry it out. A crafted prompt can bias how the planner builds that workflow, with no system access needed. The FLOWSTEER attack raised malicious success by up to 55 percent this way, because the contamination enters before any infrastructure is invoked (Can prompts alone reshape multi-agent workflows without system access?). The workflow that comes out is well-formed, so the executor has no reason to doubt it.

This is also why the usual defenses miss it. Checking only the finished workflow arrives too late, since the plan was already bent upstream (Can inspecting generated workflows catch planning-time attacks?). The blind spot goes beyond planning. The handoffs between planner, worker, verifier, and synthesizer mostly receive no inspection, and existing defenses watch only the user's input (Do internal agent hops in pipelines need security monitoring?). A filter on the model's output has the same limit. It judges one moment, while an agent's risk spreads across memory, retrieved content, and tool calls (Can a model-level filter truly contain an agent with environment access?). A correct final answer doesn't prove the process was clean either, because agents can skip required verification steps and still match the ground truth (Can a correct outcome hide protocol violations in multi-agent systems?).

Contamination also spreads unevenly, and it can take forms that are hard to see. Signals planted in high-influence subtasks travel much further than ones in peripheral nodes. Signals dressed up as task-relevant evidence get relayed by downstream agents, which is a kind of built-in sycophancy (How does a signal's position in a workflow change its influence?). Harmful intent can also be split into pieces that each look harmless, and the harm appears only when the pieces combine (Can task decomposition hide harmful intent across agents?). The subtlest form is bias that carries no explicit meaning. One compromised agent passed persistent behavioral corruption through six downstream agents using ordinary messages, and it survived paraphrasing defenses (Can one compromised agent corrupt an entire multi-agent network?).

The proposed fixes move the defense earlier or make it travel with the work. One is an input-side defense that separates the task itself from the method and framing around it. It cut malicious success by up to 34 percent, so it helps but does not solve the problem (Can inspecting generated workflows catch planning-time attacks?). Another is to attach semantic labels to the original request and pass them down the chain, so each step inherits the original intent and risk context that fragmentation removes (Can semantic labels on requests prevent malicious propagation through agent networks?). A third is to put safeguards into the memory layer the agent consults while it works, an approach a long-running agent used across 889 governance events (Can governance rules embedded in runtime memory actually protect autonomous agents?). That case wasn't about planning attacks specifically, so treat it as a direction rather than a proven remedy.