RAG Expands the Attack Surface
Retrieval-augmented generation connects models to enterprise knowledge, but retrieved content can also carry malicious instructions, outdated policy, or over-permissive context. Red teaming must test the retrieval path as carefully as the model response.
Prompt Attacks in Documents
Indirect prompt injection often hides inside tickets, webpages, PDFs, emails, and knowledge articles. A strong test program plants adversarial instructions in realistic sources and verifies whether the application follows retrieval content over system policy.
Over-Disclosure Tests
Teams should test whether the assistant reveals restricted source text, cross-tenant content, secrets, or confidential summaries. Access control drift and weak source filtering can turn a helpful assistant into a data exposure channel.
Remediation Signals
Useful findings identify the source, retrieval path, user role, model response, exploitability, and business impact. Retesting should confirm that source filtering, context inspection, and response controls actually reduced risk.