RAG poisoning plants text in a store that a retrieval-augmented generation (RAG) system searches, so that a later query retrieves it and the model answers or acts on it [5]. Memory poisoning does the same to what an agent keeps between sessions [3]. Published attacks show how little text it takes: PoisonedRAG, presented at USENIX Security 2025, reported a 90% attack success rate with five malicious texts for each target question in a knowledge database of millions of texts [7].
This report reads 34 sources: the OWASP, NIST and MITRE entries, 22 papers on attacks and defenses, and disclosed cases of memory poisoning and poisoned retrieval in production SI assistants. It sits beside indirect prompt injection, which tests each channel an agent reads, and prompt injection vs jailbreak, which separates two different failures. Here the planted text waits in storage until a query or a later session brings it back.
What RAG poisoning and memory poisoning are
MITRE ATLAS defines RAG Poisoning (AML.T0070) as injecting malicious content into data a RAG system indexes, for example by placing manipulated documents where it indexes [5]. Its AI Agent Context Poisoning technique (AML.T0080) covers an agent's memory and its threads [5]. OWASP files the agent side under ASI06 Memory and Context Poisoning, which "focuses on persistent corruption of agent memory and retrievable context that propagates across sessions" [3].
Training data poisoning is a separate attack. OWASP's LLM04:2025 entry covers manipulated pre-training, fine-tuning or embedding data [2]. The attacks here change no model weights: AgentPoison, for one, "requires no additional model training or fine-tuning" [12].
How a RAG poisoning attack works
Each attack needs three steps (derived for this report): the planted text gets in, the victim's query retrieves it, and the model acts on it [6, 7, 12, 15]. PoisonedRAG writes each malicious text in two parts, one to meet a retrieval condition and one to meet a generation condition [7]. Its attacker cannot read the knowledge database, see the model's parameters or query the model [7].
Other attacks aim at retrieval itself:
| Attack | What it plants | Reported result |
|---|---|---|
| Adversarial passages, EMNLP 2023 | Passages optimized for similarity to training queries | 50 passages misled more than 94% of questions over financial documents or online forums [8] |
| BadRAG, preprint | Passages retrieved when a query holds trigger words | 10 passages (0.04% of the corpus) gave 98.2% retrieval success and raised negative responses from 0.22% to 72% [9] |
| Phantom, preprint | One document retrieved on a natural trigger sequence | Ran end to end against a black-box production RAG application that indexes local files [10] |
| Machine Against the RAG, USENIX Security 2025 | One blocker document | The system leaves the target query unanswered [11] |
These rates are each paper's own, and a benchmark of 13 attacks reports that "BadRAG and Phantom fall short of their original reports, despite faithful reproduction" [21].
Memory poisoning in LLM agents
AgentPoison (NeurIPS 2024) poisoned the memory or knowledge base of three agents, for driving, question answering and health records, and reached an average attack success rate above 80% at a poison rate under 0.1%, with less than 1% impact on benign performance [12]. MINJA needed only ordinary use: an attacker who "behaves like a regular user" wrote malicious records into a shared memory bank through queries and output observations alone, with 98.2% average injection success and 76.8% average attack success [13]. In a May 2026 preprint, a document or web page led an assistant to store a fabricated memory about the user, and among successful retrievals the planted memories caused attacker-intended agentic actions in 60% to 89% of evaluations [15].
One benchmark measured a far lower rate. Agent Security Bench (ICLR 2025) found a 7.92% average attack success rate for its memory poisoning attack [14]. Each figure holds under its own threat model, and together they do not settle how effective memory poisoning is in general [13, 14, 15].
Persistent memory poisoning in production assistants
Researchers have planted memories in deployed assistants:
- In September 2024, Rehberger showed an untrusted document or website inserting persistent instructions into a consumer chat assistant's long-term memory, leaking what the user typed in later sessions [27]. The fix covered the leak route, and untrusted content could still make the memory tool store memories [27, 34].
- In February 2025, a delayed, conditional instruction in a document got another vendor's assistant to save attacker-chosen information to long-term memory, which the vendor assessed as an abuse-related risk "with low likelihood and low impact" [28].
- A 2025 study of 14 attack scenarios against that vendor's assistants included permanent memory poisoning of their saved information, "enabling persistent malicious activity across independent sessions" [30].
- In August 2024, an instruction posted in a public channel led a workplace messaging assistant to draw data out of private channels the attacker was not in, and the answer's citation did not refer to the attacker's channel [31].
The only in-the-wild count in the sources is promotional. In 60 days of email traffic, one vendor's researchers found 50 attempts from 31 companies to influence assistants' memory for promotional purposes, such as hidden instructions behind summarize buttons [29].
Who can write to what an agent reads
Across the attacks, the attacker needs a way to put text into something the system reads (derived for this report). They got in through edits to public pages, a file in a local folder, insert access to a knowledge database, a post in a public channel, a shared document and a link a user clicked [7, 10, 11, 19, 29, 31]. OWASP's LLM08 entry adds that poisoned data "can originate from insiders, prompts, data seeding, or unverified data providers" [1]. MITRE notes that the adversary may also set a false entry's title, author and creation date [5].
Citations do not always show what was retrieved. In the messaging case the answer's citation did not refer to the attacker's channel [31]. How to check LLM citations against their sources covers checking an answer against the passages it cites, and OWASP also asks for immutable logs of retrieval activities [1].
RAG poisoning defenses and what they measured
Filters that read the text struggled. PoisonedRAG's malicious texts had perplexity "not statistically higher than those of clean texts", and a duplicate filter left its success rate the same [7]. A benchmark of 13 attacks and 7 defenses found that "Detection-based defenses tend to have negligible impact across most attack types" [21]. On the memory side, a four-stage write-time screen rejected 0 of 360 poisoned memories made of plain false statements [16], and an adaptive attack raised one defense's injection rate from 6.2% to 64.6% on one model [15].
Structural defenses report bounded gains. RobustRAG certifies results against a bounded number of malicious passages for certain queries, with 38% certifiable robust accuracy on RealtimeQA [22]. In the same benchmark, TrustRAG's accuracy with no attack fell below plain RAG's in many settings, mostly by more than 20% [21].
The guidance turns to access and history. MITRE's Memory Hardening mitigation calls for authenticating and authorizing memory operations within user, tenant, agent and session scope, recording the source of every update and keeping known good versions for roll-back [5]. It adds that content filtering "does not replace memory access control, isolation, provenance, integrity, or recovery" [5]. Limiting what a poisoned answer can reach is the access side, covered in MCP access control with scoped credentials, allow-lists and audit logs.
What a test of a memory or retrieval path checks
OWASP's GenAI Red Teaming Manual of October 2026 has RAG tests run against dedicated, non-production vector indexes with synthetic data, and when testing reaches production it requires tagged test accounts and attacks that are "non-destructive and non-persistent" [6]. A memory test confirms that a planted instruction was stored, then checks recall in a clean session, since "a write in one account does not establish exposure to other users" [6]. A document test checks whether ingestion accepts the document, retrieval surfaces it and the model treats it as instructions or authoritative advice, and a retrieval test uses the deployed retriever and reranker [6].
Rillor's agentic security tests check whether planted content in memory, retrieved documents or earlier turns changes an agent's later decisions. Rillor tests only systems the client owns or is authorized to test, within a written scope.
Read the full report
The full report adds each attack's threat model and figures, a table of the production cases with their dates and vendor responses, the defenses' measured results and a stage-by-stage test checklist, with all 34 sources.