RAG / knowledge-base poisoning

When it applies

The app retrieves documents (from a vector store / KB / crawl / tickets / emails) and feeds them to an LLM, and an attacker can get content into that corpus. This is indirect prompt injection that persists and affects other users.

Why it works

Retrieved chunks are placed into the model's context as trusted data, but the model can't separate data from instructions. Malicious instructions embedded in a document execute when that chunk is retrieved for a victim's query — and embedding/retrieval quirks let you make your poisoned chunk get retrieved.