Prompt Injection in RAG Pipelines Is the New Supply Chain Risk

RAG systems introduce a second supply chain: the document corpus. If the corpus is untrusted or easily poisoned, an attacker can insert instructions that override your system prompt and trigger unsafe actions. This is not a theoretical edge case; we see it in customer deployments across internal wikis, PDFs, and shared knowledge bases.

What changes in RAG? The model now treats retrieved content as authoritative context. Without strict boundaries, it will follow malicious instructions hidden inside trusted documents.

We recommend treating every retrieved document as untrusted input, even if it came from “internal” sources. Attackers only need one weak link — a stale document, an unreviewed upload, or a compromised wiki page — to poison the context.

Defensive controls that matter

• Assign trust levels to sources and keep low-trust data out of high-risk actions.
• Run retrieval filtering to remove prompt-like strings and suspicious instruction patterns.
• Use a separate safety layer that enforces hard rules, independent of model output.
• Log and review model decisions that reference external documents.

Most teams already do some of this, but the key is consistency. Make guardrails part of the RAG pipeline, not an afterthought in the UI layer.