Identifying RAG Pipeline Poisoning Opportunities
RAG pipeline poisoning is viable when an attacker can influence what content ends up in the vector database that the model retrieves from. This does not require direct database write access — document upload endpoints, public knowledge bases, web content the agent retrieves, and misconfigured ingestion pipelines all represent potential poisoning paths. This page confirms which of these paths are open before attempting active poisoning in the exploitation phase.
Confirm the Application Uses RAG
Verify that retrieved context is being injected into model responses before testing for poisoning opportunities:
If the model references source documents, cites knowledge base entries, or its answer quality varies significantly between topics in ways that suggest retrieval, RAG is in use. The unique marker test confirms whether the model is performing semantic search — a positive match would only be possible if the marker was already in the knowledge base.
Identify Document Upload Endpoints
Many RAG applications allow users to upload documents that get ingested into the knowledge base. These are direct poisoning paths:
A document upload endpoint that accepts unauthenticated submissions or submissions from any authenticated user is a direct poisoning path. Upload a test document with a unique marker and then query the chatbot to confirm whether the content was ingested and is being retrieved:
A response that references the marker content confirms the upload endpoint feeds directly into the RAG pipeline and the content is being retrieved and presented to the model. This is a confirmed poisoning path — active exploitation is covered in the RAG exploitation phase.
Check Direct Vector Database Write Access
If the vector database is exposed directly, test whether it accepts unauthenticated writes:
Test Web Content Retrieval as a Poisoning Path
If the agent retrieves web content and injects it into context, attacker-controlled web pages are a poisoning path for any user who triggers retrieval of that content:
If the agent performs live web retrieval, any web page it fetches is a poisoning surface. A page containing instructions embedded in HTML comments, hidden text, or normal-looking content with injected directives will be passed to the model as retrieved context. This is confirmed as an indirect injection path if the model follows instructions from the retrieved content.
References
-
OWASP Top 10 for LLM Applicationsowasp.org/www-project-top-10-for-large-language-model-applications (opens in new tab)
LLM04: Data and Model Poisoning — RAG poisoning attack surface reference
-
Qdrant — REST API referenceqdrant.tech/documentation/interfaces (opens in new tab)
Points upsert endpoint for direct vector database write testing
Was this helpful?
Your feedback helps improve this page.