Versatile AI Risk Assessment

AI threat catalogue Application and Integration Security Production

RAG-Specific Attacks (Document Poisoning)

Attackers plant prepared documents in the knowledge base an AI system draws on via RAG (retrieval-augmented generation, looking up internal documents before answering). When retrieved, the system adopts the false content or hidden commands.

As of: October 2026 · Catalogue version 2026.10.24.2 · 7 mitigations · 11 verified sources

Description

Many corporate AI assistants ground their answers in an internal knowledge base built from wikis, drives, emails or tickets. Attackers use any path by which content enters this knowledge base: a public channel, an incoming email, a shared document, a file upload. There they place content designed to surface for specific queries, containing false facts or hidden instructions (indirect prompt injection). The model treats retrieved text as trustworthy, produces the intended false answer or follows the instruction. Attackers need no access to the model or its training for this.

Possible impact

False answers appear with the credibility of internal sources and feed into decisions. Hidden instructions can leak confidential data or trigger actions. The poisoning persists in the knowledge base and affects every future query until it is found and removed; business decisions, data protection and compliance are all at stake.

Example

An attacker sends an inconspicuous email with hidden instructions to the accounting team. The AI assistant ingests it into its knowledge base; when an employee later asks for a supplier's bank details, the assistant returns the attacker's account.

Recommended mitigations (7)

Compare effects and implementation levels. Expand each entry for the additional classification and rationale.

  • Document source validation

    Technical
    Effect
    Preventive
    Implementation level
    Data
    Classification and rationale

    Primarily technical: System-enforced inspection, transformation, or blocking rules stop or neutralize disallowed content before further processing.

  • Content integrity monitoring in knowledge base

    Technical
    Effect
    Detective
    Implementation level
    Data, Use & operations
    Classification and rationale

    Complementary control typeOrganizational & process-based

    Primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators; complemented by binding workflows.

  • Access controls on RAG document ingestion

    Technical
    Effect
    Preventive
    Implementation level
    Data, Application, API & agents
    Classification and rationale

    Complementary control typeOrganizational & process-based

    Primarily technical: Machine-enforced identity, permission, or scope rules constrain unauthorized access and actions; complemented by binding workflows.

  • Retrieval confidence thresholds

    Technical
    Effect
    Preventive, Detective
    Implementation level
    Data, Application, API & agents
    Classification and rationale

    Primarily technical: System-enforced inspection, transformation, or blocking rules stop or neutralize disallowed content before further processing.

  • Multi-source corroboration

    Technical
    Effect
    Preventive, Detective
    Implementation level
    Data
    Classification and rationale

    Primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators.

  • Regular knowledge base audits

    Organizational & process-based
    Effect
    Detective
    Implementation level
    Data, Use & operations
    Classification and rationale

    Complementary control typeGovernance & compliance

    Primarily organizational and process-based: A planned, repeatable assessment with ownership and documented follow-up creates the protective effect; complemented by rules and oversight.

  • Anomaly detection on retrieved content

    Technical
    Effect
    Detective
    Implementation level
    Data, Application, API & agents
    Classification and rationale

    Primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators.

Framework mappings

Verified locations in OWASP, NIST AI RMF, MITRE ATLAS, the EU AI Act and further frameworks. The mappings are taxonomic, not evidence of compliance.

OWASP LLM Top 10 ASI06:2026 · LLM01:2026 · LLM05:2026 · LLM09:2026NIST AI RMF NISTAML.015 · NISTAML.027MITRE ATLAS AML.T0051EU AI Act Article 25(4) · Article 9(1), 9(2)(a), 9(2)(d)BSI R18BIML BIML-LLM raw:10

Verified references (11)

Every reference states the framework, the exact location and the publishing organisation.

EU AI Act obligations related to this threat

The obligations from the obligations compass whose articles the catalogue maps to this threat. Each leads to its entry with core, action step and evidence; whether it applies to you depends on role and risk class.

  • Establish and operate a risk management system Art. 9 · applies from Annex III: 2 December 2027 · Annex I: 2 August 2028

    Statutory roles: Provider, Product manufacturer. Classes: High-risk under Annex III, High-risk as a product or safety component.

    This reference is a review prompt. A threat match alone does not establish applicability.

  • Support downstream providers Art. 25 Abs. 2, Art. 25 Abs. 4 · applies from Annex III: 2 December 2027 · Annex I: 2 August 2028 · amended by Reg. 2026/1744

    Statutory roles: Provider, Provider of a general-purpose AI model. Classes: High-risk under Annex III, High-risk as a product or safety component.

    Regulation (EU) 2026/1744 spelled out the initial provider duty to cooperate and at the same time created an exception: it does not apply where the initial provider has clearly specified that their system must not be turned into a high-risk system. Infringements of Art. 25(2) and (4) are now expressly subject to fines.

    This reference is a review prompt. A threat match alone does not establish applicability.

All 62 obligations by role, risk class and deadline in the obligations compass

Terms on this page

Glossary terms that occur in this entry. Every link leads to the full explanation.

More entries from the topic group Application and Integration Security.

Insecure Output Handling The application passes an AI model's answers to downstream systems without checks, for example to databases, web pages or command lines. Insecure Tool Design Many AI applications act on their own through connected tools, for example sending emails or querying databases. Application Vulnerabilities The software around the AI model, meaning its web interface, APIs and databases, has the same weaknesses as any other application.

Matching use cases

This list shows where to review this threat, rather than how high the risk is.

Particularly important for:

  • AI assistant in office applicationsSomeone places a document with false information in shared storage. The assistant cites it as a source and spreads the error in answers to many staff members.
  • AI knowledge assistant (enterprise search)Someone adds a document containing false or manipulated information. The assistant cites it as a source, making the answer appear particularly credible.
  • Police data analysis platformsCollections include tips and seized data that third parties may have deliberately shaped. A false entry then creates connections that recur in every later search.

Typical for:

For 12 further use cases, relevance depends on the system design, for example whether it searches its own document collection or formulates answers from retrieved documents. Show these use cases

Frequently asked questions

What is RAG-Specific Attacks (Document Poisoning)?
Attackers plant prepared documents in the knowledge base an AI system draws on via RAG (retrieval-augmented generation, looking up internal documents before answering). When retrieved, the system adopts the false content or hidden commands.
Which mitigations help against RAG-Specific Attacks (Document Poisoning)?
The catalogue lists 7 mitigations, each with control type, effect and implementation level. First among them are Document source validation, Content integrity monitoring in knowledge base and Access controls on RAG document ingestion.
Which EU AI Act obligations does RAG-Specific Attacks (Document Poisoning) touch?
The catalogue maps this threat to Art. 9 and Art. 25 Abs. 2 of the EU AI Act. In the obligations compass this leads to: Establish and operate a risk management system and Support downstream providers. Whether an obligation applies depends on role, risk class and deadline.

Assess this threat in your own system

The live demo contains all 52 threats of this catalogue, including the EU AI Act and GDPR assessment. The free single modules cover AI risk, the EU AI Act and GDPR. No sign-up; the assessment runs locally in your browser.

Start the live demo See the free modules

Cite this entry

For reports, policies or internal documents; the link leads directly to this entry.

“RAG-Specific Attacks (Document Poisoning)”. Versatile AI Risk Assessment, AI threat catalogue, as of October 2026.
https://www.versatile-ai-risk-assessment.com/en/wissensbasis/threats/rag-document-poisoning/

← Back to the full catalogue