Can chain-of-thought monitors detect reasoning that originates elsewhere?

A CoT monitor is built on an unstated premise: the trace is the actor's own reasoning, so anything alarming in it is evidence about the actor. That premise holds for a model answering a bare prompt. It stops holding once the model works inside a pipeline, and the plan injection paper names the channels: retrieved documents in RAG, tool outputs, plans from upstream planner modules, and messages from other agents. In each, the context already contains reasoning-shaped text — rationales, plans, step lists — written by someone else, and the actor's own chain of thought builds on it.

The paper's finding is what happens at that seam: actors "paraphrase the injected plan provided in context as their own and act on it downstream without attributing it to the source." Paraphrase is the provenance eraser. The words in the trace are now the actor's words; the record says who is speaking, not who thought of it first. A monitor reading that trace has no field for "this step was inherited," so it evaluates a mixed-authorship document as if it had one author — and, per the authors, does so without "critical scrutiny" from the actor itself either.

This joins a cluster of upstream-channel results in the vault. Can inspecting generated workflows catch planning-time attacks? shows the planner as a contamination point; Can one compromised agent corrupt an entire multi-agent network? shows agent messages as one; Can safety training detect attacks hidden in context rather than commands? shows fabricated rationale in context as another. Plan injection adds the monitoring consequence: the trust boundary for CoT monitoring is the context window, not the model. Anything that can write reasoning-shaped text into context sits inside the monitored surface without being monitored.

What the paper measured, and what the pipeline claim adds. The excerpt's evidence is a single actor read by a monitor (multiple-choice, coding and math tasks, DeepSeek-R1); the four pipeline channels are named in its introduction and not tested, and harder agentic tasks are on its future-work list. Under the test in Does a multi-agent setting automatically signal a security effect?, the pipeline is a delivery route here: the same failure would occur in one actor handed the same planted text. So the claim of this note is that pipelines routinely supply such text, not that they make the failure worse; whether a pipeline amplifies it would take a single-actor-versus-pipeline comparison the excerpt does not report. That reading is the vault's, not the paper's.

The counterargument is that mixed authorship is the whole point of agentic pipelines — an agent that could not build on retrieved evidence or a planner's output would be useless — so "just don't trust inherited reasoning" is not available as a design. The narrower implication is that a monitor which never sees the context can't tell inherited reasoning from original reasoning; whether giving it the context and comparing helps is an untested candidate, taken up in Can monitors catch plan injection attacks in chain-of-thought reasoning?.