AI Research Roundup: Agent Attacks, Replay, and Risk
New arXiv papers show planning-phase prompt injection breaks multi-agent systems, deterministic replay fixes agent debugging, and LLMs converge on narrower risk attitudes than humans.
8 min read
Three papers landed on arXiv this week that all return to the same question: what happens when you actually stress-test the agent systems everyone is shipping right now. One finds a structural blind spot in multi-agent pipelines. One builds the debugging primitive agent developers have been missing. One measures something nobody had bothered to quantify before - whether LLMs behave like a consistent decision-maker when the stakes involve risk, not just correctness.
TL;DR
- PlanFlip - Injecting attacks into the planning phase of multi-agent LLM systems works better on stronger models, and same-backbone Critic agents share a blind spot for catching it.
- Deterministic Replay for AI Agent Systems - A new open-source tool records every non-deterministic input to an agent run and replays it with perfect fidelity, cutting debugging iteration time by over 98%.
- Consistent Risk Attitudes - LLMs make internally consistent risk decisions across wildly different domains, but as a group they cluster into a narrower risk profile than the humans they're meant to assist.
| Paper | Core finding | Who should care |
|---|---|---|
| PlanFlip | Same-backbone Planner/Critic pairs share a blind spot; stronger models are easier to fool at the planning stage | Anyone running multi-agent pipelines in production |
| Deterministic Replay | A proxy-based tool replays agent runs with perfect fidelity and 98.3% less latency than re-running live | Anyone debugging flaky agent failures |
| Consistent Risk Attitudes | LLMs are internally consistent but collectively narrower in risk appetite than humans | Anyone using LLMs for triage, allocation, or other risk-bearing decisions |
PlanFlip exposes the planning phase as the weak link
Most prompt injection research targets the moment an agent reads a poisoned tool output or web page mid-execution. PlanFlip, from researcher Yuhang Wang, goes after an earlier and less-scrutinized target: the planning phase, where a multi-agent system decides what it's even going to do.
The paper introduces four attack variants - GoalSubstitution, PriorityInversion, ContextPollution, and RoleConfusion - all built to slip past keyword filters by mimicking legitimate tool output rather than looking like an obvious injected instruction. Once a poisoned plan gets past the planner, it propagates to every downstream agent that executes against it.
Two findings stand out. First, what the paper calls a "capability paradox": GPT-5 was hit with a 68% attack success rate, meaning the more capable model was easier to manipulate at the planning stage, not harder. Second, and more useful for anyone actually building these systems, homogeneous pipelines - where the Planner and the Critic agent share the same model backbone - exhibit what the authors call a "correlated-agent blind spot." A same-family Critic tends to approve a restructured plan because it reasons about the plan the same flawed way the Planner did, even when the plan has been quietly hijacked.
DeepSeek-R1 was the outlier, resisting injection across every attack type the paper tested, which the authors attribute to its reasoning-heavy training making it harder to fool with surface-level plan restructuring. That's worth flagging on a model page like DeepSeek-R1's since it's a concrete security data point, not just a benchmark score.
The practical fix the paper proposes is two defenses - GoalAnchorCheck and CrossAgentConsensus - which pin the plan back to the original stated goal and cross-check it against a structurally different model, respectively. Combined, they hit up to 100% detection in the paper's tests. If you're building or evaluating a multi-agent stack, this is directly relevant to the calculus behind our jailbreak and red-team resistance leaderboard and to the model-diversity choices covered in our agent framework comparison: a Planner and Critic from the same lab, same family, is a design decision with a measurable security cost.
Deterministic replay finally makes agent bugs reproducible
Anyone who has tried to debug a flaky agent run knows the problem: the failure happened once, at 2am, against a live API, and you cannot get it to happen again. Deterministic Replay for AI Agent Systems, by Rasheed Mudasiru, tackles this directly with a tool called agrepl.
The paper's framing of the problem is blunt and correct: agent systems combine "LLM sampling variance, external API state, CDN infrastructure headers, and execution-environment noise," and any one of those is enough to make a prior run unrepeatable. Setting temperature to zero doesn't fix this - it only removes one of four sources of nondeterminism, which is a point worth remembering the next time someone tells you their agent is deterministic because they set a single parameter.
Agrepl works as a proxy that sits between the agent and the outside world. It intercepts every network call, records it as a structured trace, and can later replay that exact trace in an isolated offline environment - no live API calls, no flaky network, no drifting model weights. The technical core is a request-matching function the paper calls K(s), plus a differential algorithm for HTTP headers that separates meaningful variation (a changed auth token) from noise (a CDN's rotating cache header) so replay doesn't break on cosmetic differences.
The results: perfect fidelity across five test scenarios and 250 replay instances, with a 98.3% median reduction in latency versus re-running against live services.
That latency number matters more than it looks. If you can replay a failing agent path in a fraction of a second instead of waiting on live API round-trips, you can actually iterate on a fix - which is the difference between agent debugging being possible and being a research exercise. Agrepl is written in Go, ships as a standalone binary, and is released under the MIT license, which puts it in the same practical category as the tools covered in our agent sandboxing roundup: infrastructure that exists because production agents kept breaking in ways nobody could reproduce.
LLMs have risk attitudes - and they're narrower than ours
The third paper asks a question that sounds almost obvious once you read it, and that's exactly why nobody had answered it properly: do LLMs behave like a consistent decision-maker when a task involves genuine risk, or do they just pattern-match whatever sounds reasonable in the moment?
Some Large Language Models Exhibit Consistent Risk Attitudes, by Bowen Sun, Rui Min, Yuxi Wang, Brian Odegaard, Qi Wang, and Jing Du, tested six LLMs against 100 human participants across three deliberately unrelated task domains: spatial navigation, clinical triage, and financial allocation. The goal was to see whether a model's risk preference in one domain predicts its behavior in a completely different one, the way it reliably does for most humans.
It does. The paper reports "robust intra-task consistency," meaning a model's mapping from a given belief about uncertainty to a risk decision stays stable within a task, and "cross-domain rank-order stability," meaning a model that's fairly risk-seeking in financial allocation tends to also be fairly risk-seeking in clinical triage. That's a real behavioral property, not noise - and it means risk attitude is measurable and can be benchmarked the same way factual accuracy or reasoning ability can, which is directly relevant to how we think about model coverage on our AI safety leaderboard.
The catch is in the second finding: across six models, the risk attitudes converge toward a "restricted risk-attitude distribution relative to the broader human baseline." In plain terms, humans span a wide range from very risk-averse to very risk-seeking, and current LLMs cluster much closer together, occupying a narrower slice of that range. If you're deploying an LLM as a decision aid in something like clinical triage or financial allocation, that's not a minor detail. It means the model's risk posture may not represent the diversity of risk tolerance among the humans it's actually meant to serve, and a single model launched at scale could be systematically nudging decisions toward one narrow risk profile rather than reflecting the range of reasonable choices a human population would make.
The common thread: agents are getting audited, not just benchmarked
Put these three side by side and a pattern emerges that's bigger than any single result. PlanFlip is an audit of trust between agents in a pipeline. The replay paper is an audit of whether you can even trust your own logs. The risk-attitude paper is an audit of whether the model's decision-making style matches the humans it's supposed to serve. None of these are capability benchmarks - none of them ask "can the model do the task." They ask "does the system behave the way we assumed it did," and in each case, the honest answer turns out to be more complicated than the marketing.
That shift, from measuring what agents can do to measuring what they actually do under adversarial or ambiguous conditions, is where a lot of the useful research is heading right now. If you're building or shipping agent systems, all three papers are worth reading in full, not just skimming the abstract.
Sources
