RAG Poisoning: How Attackers Corrupt Your AI Knowledge Base
Marcus Webb
Principal Security Engineer · June 22, 2026
Retrieval-Augmented Generation has become the default pattern for grounding LLM answers in real company data. It is also quietly becoming a high-value attack target. Security researchers this month demonstrated that inserting as few as five adversarially crafted documents into a corporate knowledge base is enough to reliably redirect an AI assistant's answers, exfiltrate retrieved context, or suppress correct information for targeted queries. The vector database your RAG pipeline reads from is now part of your threat model.
Why RAG poisoning is hard to detect
A poisoned RAG document does not exploit a code bug. It exploits the model's instruction-following. A malicious document can carry hidden instructions that the retriever surfaces at exactly the right query, and the LLM faithfully executes them because they look like authoritative context.
Unlike a classic database injection, there is no error, no anomalous query, and no obvious log entry. The assistant simply starts giving different answers to targeted questions, and attribution is nearly impossible without auditing retrieval traces.
The attack patterns researchers demonstrated
The published research catalogued three distinct poisoning strategies that teams should defend against now.
- Instruction injection: documents containing hidden directives that override system prompt behavior
- Context hijacking: high-similarity documents that out-rank legitimate sources and replace correct answers
- Exfiltration anchors: documents that cause the model to echo retrieved context to an attacker-controlled URL
- Denial of retrieval: poisoned embeddings that suppress specific topics from appearing in results
How RASMISER helps secure RAG integrations
RASMISER audits how your app populates and queries RAG pipelines, flags where retrieved content flows unfiltered into prompts, and identifies retrieval paths that could expose sensitive context to injection, mapped to OWASP MASVS.
Combined with runtime monitoring, the retrieval and inference paths in your app stay observable, so anomalous retrieval patterns surface as alerts rather than silent mis-answers delivered to every user.
The takeaway
Your RAG pipeline is only as trustworthy as the documents inside it. Treat ingestion as a security boundary, validate retrieved content before it reaches a prompt, and monitor retrieval behavior for poisoning indicators.
Scan your app free
