Study shows injected plans can evade chain-of-thought monitors

Researchers plant benign-sounding harmful plans in an actor model’s context. The actor follows the plan and restates it as its own reasoning, while monitors miss 25–33% of attacks across tested settings. Giving a monitor the injected plan can reduce detection further in one task. The evidence comes from controlled benchmarks, not production incidents.

Teams relying on reasoning traces for agent safety should test whether external context can launder a plan into apparently clean reasoning. Keep independent action-level checks even when the trace looks benign.