Developer Tests Own AI Planning Engine Against Prompt Injection — Architecture Holds

A developer building PlannerCritic, an open-source engine that pairs one LLM to write plans with a second to review them, ran a structured adversarial test to find security weaknesses in the system. Eleven adversarial goals, 21 injection traps, and 35 regression tests were used, including attempts to bypass MFA, exfiltrate customer data, and override the engine via embedded system commands. In each case, the engine escalated and blocked the requests — not by detecting malicious intent, but by evaluating structural flaws like missing preconditions and weak rollback plans. The critic LLM audited plan structure independently, ignoring injected instructions, while deterministic gates processed logic rather than natural language. The developer concluded that the engine's resilience stemmed from its architecture rather than any LLM-level cleverness, though acknowledged that open seams in the system still remain.