{"id":5093,"date":"2026-08-24T12:15:04","date_gmt":"2026-08-24T12:15:04","guid":{"rendered":"https:\/\/www.hackmosphere.fr\/rag-poisoning-when-the-knowledge-base-becomes-a-cyberattack-weapon\/"},"modified":"2026-08-27T10:23:41","modified_gmt":"2026-08-27T10:23:41","slug":"rag-poisoning","status":"publish","type":"post","link":"https:\/\/www.hackmosphere.fr\/en\/rag-poisoning\/","title":{"rendered":"RAG poisoning: When the knowledge base becomes a cyberattack weapon"},"content":{"rendered":"

[et_pb_section fb_built=”1″ _builder_version=”4.16″ global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_row _builder_version=”4.16″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” width=”79.1%” min_height=”3794.9px” custom_padding=”46px|||2px||” global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_column type=”4_4″ _builder_version=”4.16″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||” theme_builder_area=”post_content”][et_pb_text _builder_version=”4.27.8″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” width=”99.8%” custom_margin=”|||1px||” hover_enabled=”0″ global_colors_info=”{}” theme_builder_area=”post_content” sticky_enabled=”0″]A case reported by AI Alert<\/a> illustrates the risk of knowledge base (RAG) poisoning in a corporate setting. At a financial services company, an internal HR assistant\u2014powered by a RAG corpus of HR policies\u2014reportedly provided an incorrect reimbursement threshold for expense reports after a file containing hidden malicious instructions was uploaded to the shared SharePoint site. <\/a>The anomaly evaded standard control mechanisms and was reportedly detected only during an audit. This incident, which comes on top of other documented cases from 2025\u20132026, illustrates why RAG poisoning is now considered one of the most insidious threats targeting enterprise AI deployments. <\/p>\n

<\/p>\n

RAG Poisoning Attack: A Hacking Mechanism That Targets the Data, Not the LLM Model<\/h2>\n

RAG (Retrieval Augmented Generation) enriches a model’s responses with documents retrieved from a knowledge base at the time of the query, in order to ground its responses in proprietary or up-to-date data rather than solely in its training knowledge.<\/p>\n

RAG poisoning involves injecting malicious content into this knowledge base, so that the retrieval system returns this poisoned content alongside legitimate results; the model then incorporates the malicious payload into its response without distinguishing between a trusted source and a compromised one. This is what structurally distinguishes it from classic prompt injection<\/a>: the latter targets the model\u2019s obedience behavior during a session, while poisoning corrupts the retrieval layer itself, prior to any interaction with the end user. <\/p>\n

<\/p>\n

RAG Attack Vector: Proven Effectiveness with a Minimal Amount of Data<\/h2>\n

The PoisonedRAG<\/a> study, published at the 34th USENIX Security Symposium in 2025, shows that the knowledge bases used by retrieval-augmented generation (RAG) systems can be manipulated by injecting malicious text. Specifically, the experiments revealed that injecting just five poisoned documents per target question\u2014that is, the specific query an attacker seeks to hijack\u2014is sufficient to achieve a 90% success rate, even within a massive corpus containing millions of legitimate texts. This result highlights an asymmetry between the size of a document corpus and the small number of texts required to influence certain responses. <\/p>\n

A technique called Phantom<\/em><\/a> takes discretion even further: it proposes a backdoor attack against RAG systems, using a single malicious document injected into the knowledge base. This document is designed to be retrieved primarily when the query contains a specific trigger sequence (such as a keyword); it can then influence the model\u2019s response or pursue other malicious objectives. The attack thus remains dormant for queries that do not contain this trigger, which can make it difficult to detect using controls that rely solely on ordinary queries or aggregated indicators. <\/p>\n

<\/p>\n

AI Security and Data Poisoning: Why This Vector Evades Traditional Defenses<\/h2>\n

RAG poisoning<\/em> shares a characteristic with other forms of data poisoning that makes it particularly difficult to detect: it causes neither system failures nor visible errors. The logs remain clean, responses remain smooth and confident, and the system continues to function normally on the surface while silently disseminating manipulated information. A study conducted on the Waze navigation system<\/a> illustrates this principle outside the strict context of generative AI: an attacker could use Sybil devices\u2014that is, software clients simulating vehicles\u2014to transmit false traffic congestion or road sign data. This data could then influence traffic estimates and trigger the automatic rerouting of users, without any modification to the system\u2019s code or internal parameters. <\/p>\n

The probabilistic nature of the models and the variety of malicious content mean that simple filtering based on banned words or a single confidence score is insufficient. The 2025 edition of the OWASP Top 10 LLM<\/a> identifies two relevant risks: LLM05:2026 \u2013 Data and Model Poisoning<\/strong> and LLM09:2026 \u2013 Vector and Embedding Weaknesses<\/strong>, which covers, in particular, vector databases and the retrieval mechanisms of RAG systems. <\/p>\n

LLM08<\/strong> represents an evolution of the OWASP taxonomy aimed at better accounting for the risks associated with embeddings and vector search; however, this classification alone is not sufficient to demonstrate the growing sophistication of RAG attacks.<\/p>\n

<\/p>\n

RAG Protection and Cybersecurity: A Multi-Layered Defense, Not a Single Measure<\/h2>\n

<\/p>\n