Plan injection evades chain-of-thought monitors 25-33%, and giving the monitor more resources makes it worse.

Planting benign-sounding reasoning in an agent's context steers it to adversarial actions while the trace still reads clean, scaling to DeepSeek-R1 (arXiv 2609.15989). Actors paraphrase the injected plan as their own reasoning with no attribution. Giving the monitor access to the injected plan drops detection by up to 50% on Bio-Math, and in a reasoning-budget case study the extra thinking tokens get spent rationalizing the plan rather than flagging it. More monitor compute is not a defense here.