Why doesn't keeping an AI's planner away from untrusted content fully stop attackers from hijacking what it does?

This explores why splitting an AI agent so that the planner never sees untrusted content still leaves room for attackers, who go after the data the plan uses instead of the plan itself. The short answer: isolation protects *what the agent decides to do*, but not *what it does it with*. In Willison's Dual LLM pattern, a privileged model writes the plan and a quarantined model handles emails, web pages and documents. The authors of CaMeL showed that this does stop hijacking of the plan, but an attacker can still poison the values pulled out during execution Does isolating planning from untrusted data actually stop prompt injection?. Suppose the plan says "find the invoice and pay the amount to the listed account." The steps stay intact, but the account number came from a document the attacker wrote. The control flow is clean and the data flow is contaminated.

This is why the strongest design patterns are described as cutting the path from untrusted input to *consequential actions*, not just to the planner Can structural design patterns block prompt injection attacks?. Patterns like Plan-Then-Execute and Action-Selector give real guarantees, but only for the paths they actually cut. Value manipulation slips through because the attack never needs to change the plan. It only needs to fill one of the plan's blanks. One fix is to stop trusting the model to police itself and check every step with something outside it. Progent, for example, uses a formal solver to check each proposed change to the agent's permissions. Changes that narrow what the agent can do go through automatically. Changes that widen it are blocked, even if the model has been manipulated Can an SMT solver prevent LLM policy drift during agent execution?.

The lesson gets sharper when you notice that the planner isn't always safe even when it's isolated. FLOWSTEER shows that a crafted prompt can bias *how the workflow gets formed* in planner-executor systems, before any defense that inspects workflows switches on. That raised malicious success rates by up to 55% Can prompts alone reshape multi-agent workflows without system access?. So attacks can enter before the plan exists (steering it) or after it exists (poisoning its inputs). Isolation guards only the moment in between.

There's a deeper pattern here that shows up across very different attacks: defenses that check one piece at a time miss harm that only appears when the pieces combine. SafeFlow finds that splitting a harmful goal into subtasks across agents makes each step look harmless on its own Can task decomposition hide harmful intent across agents?. ColluSkill reaches 96% attack success against skill scanners because the scanners score each skill alone. Attackers tune each piece to look clean while the chain as a whole stays malicious Can attackers evade skill scanners by refining individual skills?. Value manipulation is the same failure inside a single agent. The plan passes inspection, the data passes inspection, and the harm lives in the combination.

The takeaway you might not have expected: "keep the planner clean" is a good principle, but it is half a defense. Real protection means tracking where each value came from and limiting what tainted values are allowed to trigger, enforced by machinery outside the model. That's the same reason researchers argue even basic guarantees like an agent stopping need supervisors outside the agent's own loop Can prompt alignment alone guarantee agent termination in loops?.