Skip to content
REDMAW

AI Security

Indirect injection in retrieval pipelines

How untrusted content reaches an agent's context through retrieval, and what makes a pipeline testable.

RedMaw Research9 min read

Retrieval-augmented pipelines assemble a prompt from sources with very different trust properties: curated documentation, user uploads, ticket bodies, crawled pages, shared drives. Once assembled, the model treats the result as a single instruction surface.

Boundary analysis

  1. 01Enumerate every source that can place text into the context window
  2. 02Determine which sources accept content from outside the trust boundary
  3. 03Identify the actions available to the agent after assembly
  4. 04Test whether content from a low-trust source can influence those actions

Why static filtering under-performs

Pattern-based input filtering assumes injection looks adversarial. In practice, effective indirect injection reads like ordinary operational text and arrives through a legitimate document. Validation has to be behavioral: did the agent's action change?

Tags

  • prompt injection
  • rag
  • retrieval
  • agents

Keep going

Related

Further reading

Attack LibraryAI Systems

Indirect Prompt Injection

The attacker never talks to the model. The content the model reads does it for them.

· 7 min read
Attack LibraryAI Systems

RAG / Context Poisoning

If you can influence what gets retrieved, you can influence what the system does with it.

· 6 min read

Stop assuming you are secure. Prove it.

Continuously test what an attacker can actually reach across your applications, SaaS identities, internal infrastructure and AI systems.