Your RAG Pipeline Is an Untrusted Input Channel
Retrieval-augmented generation quietly turned every indexed PDF, ticket and wiki page into executable instructions. Here is what the 2026 attack pattern looks like — and the five controls that actually hold.
Most enterprise RAG deployments still treat retrieved context as data. The model does not. Every chunk the retriever pulls in lands in the same token stream as your system prompt, and the model has no reliable way to tell your instructions from a sentence somebody typed into a support ticket eighteen months ago.
That is the whole vulnerability class, and in 2026 it is the single most common finding in our assessments of production assistants.
How the attack actually runs
- Seed. An attacker plants text in a source your index crawls: a shared drive, a public docs site, a CRM note, a resume, a supplier invoice PDF.
- Wait. The nightly ingestion job embeds it. No alert fires — indexing succeeded.
- Trigger. A legitimate employee asks a question whose embedding lands near the poisoned chunk.
- Act. The chunk instructs the assistant to summarise the conversation, append it to a URL, and call the browsing tool. The employee sees a perfectly normal answer.
Why the usual defences miss it
Input filtering inspects what the user typed, and the user typed nothing malicious. Output filtering inspects the answer, and the answer looks fine. The damage happens in the tool call between them. Guardrail products that only wrap the prompt and the completion have no visibility into that middle step.
Five controls that hold up
1. Provenance on every chunk
Store source system, author, ingestion date and trust tier with each embedding. An assistant answering finance questions should not silently retrieve from an unauthenticated public crawl.
2. Tool calls are privileged, retrieval is not
Never let retrieved text reach a code path that can trigger an outbound request, a write, or a payment. If retrieval can influence tool selection, retrieval is code execution.
3. Egress allowlists
Exfiltration needs a destination. An allowlist of outbound hosts for the assistant's tools removes the entire class of markdown-image and URL-callback exfiltration in one change.
4. Retrieval logging that a human can read
For every answer, log the chunk IDs that were retrieved. Incident response without this is guesswork; with it, you find the poisoned document in minutes.
5. Continuous injection testing
Run a corpus of known injection payloads against your own index on every deploy. The pass criterion is not "the model refused" — it is "no tool fired."
If retrieved content can change what your assistant does rather than only what it says, you do not have a retrieval system. You have a remote code execution path with good manners.
