RAG Pipelines Face Serious Security Risks From Malicious Retrieved Documents

Retrieval-augmented generation (RAG) systems, widely used to ground large language models in private data, introduce a significant security vulnerability by pulling external documents directly into the model's prompt context. Because models cannot distinguish between instructions and data, attackers can embed malicious commands inside indexed documents — such as wiki pages, PDFs, or support tickets — to manipulate model outputs, a technique known as indirect prompt injection. RAG pipelines also risk exposing confidential data when vector stores return document chunks to users who lack authorization to view them, effectively leaking one user's private files to another. Additional threats include knowledge-base poisoning, where bad actors seed crafted documents to steer future query responses, and verbatim leakage of sensitive or personally identifiable information stored in the index. Security experts recommend enforcing access controls at retrieval time, treating retrieved content as untrusted data, restricting what actions model outputs can trigger, curating indexed content carefully, and filtering responses for sensitive information before delivery.