A Retrieval-Augmented Generation (RAG) system stores documents in a vector database. When a user asks a question, the agent embeds the query, retrieves the most semantically similar stored chunks, and includes them as context in its prompt. The agent answers based on what it retrieved.

The attack target is the ingestion pipeline — the process by which new documents enter the vector store. If an attacker can control the content of a document that gets ingested, they can write arbitrary context that will be retrieved whenever a user asks a semantically related question.

One write, many readers. A single poisoned document can be retrieved into thousands of future conversations — from a single ingestion event. Unlike other memory poisoning types that target one user's session, RAG poisoning is inherently multi-user: it affects everyone whose query is semantically similar to the poisoned content.

High retrieval confidence. A well-crafted poisoned document is designed to score high semantic similarity for the target query. The attacker can test and optimize retrieval ranking before submission — making the attack highly reliable.

Trusted source halo. Retrieved RAG content is typically presented to the model as "background knowledge" or "relevant context" — a higher-trust framing than live user input. The model is more likely to accept retrieved content as factual.

Security researchers (Greshake et al., 2023) demonstrated that if an agent is instructed to browse the web and incorporates retrieved content into its RAG store, an attacker can publish a web page containing both legitimate-looking content and hidden instructions optimized for retrieval. When another user's query triggers retrieval of this page, the injected instructions appear as trusted "retrieved context" in the agent's prompt.