The Planner Trusted the Wrong State: A New Security Boundary for Embodied Agents

TL;DR for operators

An embodied agent can receive the correct user instruction and still plan toward the wrong objective if the internal description of its environment has been manipulated. Liu et al. test this failure mode by altering planner-visible state semantics rather than changing the instruction, model, planner, executor, or environment itself.¹

The strongest result is also the most operationally revealing. With DeepSeek-V4-Pro on AI2-THOR, the attack achieved 100.00% planning-level attack success but only 48.08% execution-level success. The planner almost always adopted the adversarial objective, yet more than half of those compromised plans did not produce the intended final-state consequence.

For teams building robots or other embodied agents, this shifts part of the security problem away from prompt filtering alone. Internal state stores, maps, task-state managers, caches, and execution-feedback channels can become privileged inputs to planning. The paper supports protecting those interfaces with provenance, producer authorization, consistency validation, and checks before consequential actions execute. It does not establish how often an attacker can corrupt those state channels in production, nor does it test a comprehensive defense stack.

A correct instruction can still produce an attacker-aligned plan

A typical embodied agent receives a benign task, observes or reconstructs its surroundings, converts that information into representations of objects, spatial relations, affordances, task stages, and execution feedback, and passes those representations to a planner.

Security work often focuses on the obvious places where hostile influence may enter: the user’s instruction, retrieved content, the model itself, or perception. This paper asks what happens one layer later, after information about the world has already been converted into planner-readable state.

Its attack, Environment State-Text Injection (ESTI), changes selected semantic values inside that state. The adversarial objective is encoded as false but schema-compatible evidence. The original user instruction remains unchanged. So do the planner, model parameters, executor, controller, environment dynamics, and true state at injection time.

That makes the result more specific than a general claim that LLMs can be manipulated. The vulnerable interface is the planner’s evidence about the world.

Representation fit, not just adversarial language, drives the attack

ESTI does not simply append a hostile command to the context. It constrains the injected state to the structure the planner normally expects: the schema is preserved, referenced entities already exist, supported actions remain grounded in the environment, and related records are kept mutually consistent.

The main cross-environment comparisons show that this design matters. Across ProgPrompt/VirtualHome, VoxPoser/RLBench, and AI2-THOR/iTHOR, ESTI records the highest reported planning- and execution-level attack success for every evaluated planner-environment combination.

With DeepSeek-V4-Pro, average planning-level attack success reaches 99.12%, compared with 80.49% for Vanilla IPI, the strongest overall baseline. Average execution-level success is 45.75% for ESTI versus 34.62% for Vanilla IPI.

The ablation provides the sharper mechanism evidence. On AI2-THOR:

Removing native-carrier matching collapses planning success from 100.00% to 12.50%. Removing representation consistency reduces it to 37.50%. Runtime re-grounding has a much smaller incremental effect under the paper’s already matched groundability conditions.

The useful interpretation is not that one formatting trick defeats a planner. The attack becomes effective when false evidence looks like a legitimate member of the representation the planner has been trained or engineered to consume. For security review, the question is therefore not merely whether adversarial text exists in context, but whether an unauthorized producer can write semantically credible records into trusted state channels.

Planner compromise and realized consequence are separate events

ESTI-Bench measures two stages separately. Planning-level attack success, P-ASR, records whether the generated plan adopts the adversarial objective. Execution-level attack success, E-ASR, records whether normal execution actually produces that objective in the final environment state.

The distinction prevents a near-certain planning compromise from being misread as near-certain physical impact.

For DeepSeek-V4-Pro, average P-ASR is 99.12%, while average E-ASR is 45.75%. On the three tested environments, reported transfer rates range from 43.25% to 48.08%.

Execution introduces constraints that language-level persuasion cannot remove: object availability, reachability, available action primitives, action preconditions, plan quality, and platform-specific limitations can all prevent an attacker-aligned plan from becoming an attacker-aligned final state.

Planner susceptibility also varies more across models than execution success. ESTI’s average P-ASR is 99.12% for DeepSeek-V4-Pro, 79.06% for GPT-5.6-luna, and 97.04% for Qwen-3.6-Plus. Their corresponding average E-ASR values are much closer: 45.75%, 46.44%, and 47.77%.

For red teams, that argues for reporting both compromise and consequence. Action-sequence deviation is also insufficient by itself: a plan can differ substantially from the clean plan without achieving the attacker’s specified outcome.

Internal state needs governance, not implicit trust

The paper directly establishes a conditional security result: once adversarial state semantics reach the planner-visible interface, representation-compatible manipulation can redirect planning more effectively than the evaluated command-, suffix-, and jailbreak-oriented baselines.

Cognaptus extends that result into an architectural recommendation.

For robotics teams, autonomous-system developers, and platform owners, planner-visible semantic state should be handled more like a privileged control input than ordinary middleware. Relevant controls could include authenticated state producers, provenance records, write permissions, schema and cross-record validation, consistency checks between semantic state and independent perception, and verification before irreversible actions execute.

The experiment does not establish which of those defenses will work best. It does show why model-level defenses alone leave part of the pathway untouched: the tested attack changes neither the model nor the benign instruction.

The planning-to-execution gap also identifies a second intervention point. Even when planner integrity has failed, execution policies can still constrain realized damage. In deployments where actions alter inventory, machinery, doors, vehicles, or human environments, verification immediately before consequential state changes may provide a separate containment layer.

The paper measures propagation after state corruption, not compromise probability

The benchmark deliberately begins after the planner-visible state boundary has been breached. It therefore measures how manipulated state semantics propagate, not how frequently attackers can obtain that access.

That boundary is material. The reported attack-success rates should not be interpreted as estimates of production compromise probability.

The real-humanoid-robot experiment should also be read as a proof of downstream propagation rather than a complete physical-world attack. The researchers manually instantiate textual environment state; onboard perception is not itself compromised. Changing that text redirects the robot from its intended route toward a computer, showing that planner-visible state manipulation can alter physical execution, but not demonstrating an end-to-end perception-to-action exploit.

The benchmark further covers three simulated embodied environments, three planning models, fixed prevalidated adversarial objectives, and one controlled physical demonstration. Adaptive corruption in longer-running dynamic environments, broader sim-to-real transfer, and defense effectiveness remain open.

Secure the evidence the planner acts on

The paper’s most useful reframing is architectural. An LLM planner does not act only on instructions. It acts on claims about what exists, where things are, what actions are possible, what has already happened, and what remains to be done.

If those claims can be rewritten by an unauthorized source while preserving the representation the planner expects, a benign instruction does not preserve planner integrity.

At the same time, corrupted reasoning is not equivalent to realized harm. Execution still imposes constraints, and those constraints can become part of the defense design.

For operators, the resulting security model has at least two boundaries to test: whether the planner can trust its state evidence, and whether a compromised plan is allowed to change the environment without independent verification.

Cognaptus: Automate the Present, Incubate the Future.