PoisonedRAG is a retrieval-augmented generation attack where malicious or misleading content is inserted into the retrieval corpus so an AI system pulls it into its generated output. The poisoned data can steer answers, leak sensitive context, or cause unsafe actions because the model trusts retrieved material as part of its prompt.
How PoisonedRAG works
PoisonedRAG attacks the retrieval layer rather than the base model. An adversary places malicious, misleading, or subtly skewed content into a corpus, index, or knowledge base so the system retrieves it as trusted context during generation.
The attack succeeds because retrieval often acts as an authority shortcut. If the model is allowed to treat retrieved text as grounding, poisoned entries can shape facts, framing, tool choices, and downstream recommendations without changing the model weights themselves.
Why PoisonedRAG is dangerous
The main danger is that bad content inherits the credibility of the retrieval pipeline. A poisoned source can cause a model to answer incorrectly, expose sensitive context, or recommend unsafe actions while still appearing to be grounded in the system’s own knowledge.
This is especially risky in shared corpora, externally sourced knowledge bases, and large document stores where content provenance is uneven. The attack surface expands when ingestion is automated and retrieval trust is broad.
Where PoisonedRAG enters the retrieval pipeline
Poisoning can happen at ingest time, through compromised upstream sources, or by inserting documents that are optimized to rank well for likely queries. It can also arise when attackers exploit weak curation, poor metadata hygiene, or permissive write access to the retrieval store.
Once the poisoned material is indexed, it may persist across many queries and users. That makes the impact systemic, because a single tainted document can affect multiple answer paths, not just one prompt.
In RAG-heavy systems, the practical control problem is trust segmentation. RAG Security Guide is useful here because it covers source trust, corpus and retrieval poisoning, and grounding checks that directly address this failure mode.
What defenders should verify and monitor
Defenders should treat retrieval content as a security boundary, not a passive library. That means checking provenance, reviewing ingestion paths, validating source ownership, and watching for anomalies in what gets retrieved for sensitive or high-impact prompts.
Detection should focus on unusual document additions, suspicious embedding or index changes, retrieval from low-trust sources, and answer drift after corpus updates. Post-incident review should include the corpus, the retrieval logs, and any sensitive context the model may have surfaced from the poisoned material.
For agentic systems, the retrieval layer can become part of a broader memory-poisoning problem, especially when context is reused over time. OWASP Agentic Top 10 ASI06 Guide is relevant because it explains memory and context poisoning, provenance, segmentation, rollback, and detection metrics.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1565 — Data Manipulation | PoisonedRAG is corpus or retrieval data manipulation that alters what the system uses as trusted context. |
| Recommendation — Monitor retrieval corpora for tampering and hunt for unauthorized content changes that can steer downstream outputs. | ||
| OWASP Agentic AI Top 10 | ASI06 — Memory & Context Poisoning | The attack injects misleading context that shapes agent or RAG outputs through poisoned retrieval material. |
| Recommendation — Apply ASI06 controls to enforce provenance, segmentation, rollback, and detection for trusted context stores. | ||
| NIST SP 800-53 Rev 5 | SI-4 — System Monitoring | PoisonedRAG requires monitoring retrieval stores and ingestion paths for suspicious or unauthorized changes. |
| SI-7 — Software, Firmware, and Information Integrity | Integrity controls directly support trust in retrieved knowledge and prevent manipulated content from being accepted. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Audit review helps trace who changed the corpus and what content influenced generated answers. | |
| Recommendation — Use SI-4 to detect anomalous corpus updates, retrieval drift, and suspicious context injection activity. Use SI-7 to verify retrieved content integrity and reject tampered or untrusted knowledge entries. Use AU-6 to review ingestion and retrieval logs for malicious additions and post-compromise evidence. | ||
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 28, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org