Retrieval-augmented pipelines assemble a prompt from sources with very different trust properties: curated documentation, user uploads, ticket bodies, crawled pages, shared drives. Once assembled, the model treats the result as a single instruction surface.
Boundary analysis
- 01Enumerate every source that can place text into the context window
- 02Determine which sources accept content from outside the trust boundary
- 03Identify the actions available to the agent after assembly
- 04Test whether content from a low-trust source can influence those actions
Why static filtering under-performs
Pattern-based input filtering assumes injection looks adversarial. In practice, effective indirect injection reads like ordinary operational text and arrives through a legitimate document. Validation has to be behavioral: did the agent's action change?
Tags
- prompt injection
- rag
- retrieval
- agents