Orbyntis — Building and Securing Autonomous IntelligenceRequest a Briefing

Retrieval Boundary

RAG Data Leakage in AI Agents

Retrieval-augmented generation creates a security boundary around indexes, chunks, metadata, query expansion, summaries, and retained evidence.

A restricted source fragment crosses from one document compartment into another user's response.
Check what crosses the retrieval boundary.

Definition

What is RAG Data Leakage?

RAG data leakage happens when retrieval, context assembly, generated responses, citations, memory, or logs expose information beyond the requester's authority.

The model may never query a database directly yet still reveal protected information through retrieved passages or generated summaries.

Attack Scenarios

Where this shows up in real agent workflows.

The exact exposure depends on authority, connected systems, identity, approval state, and evidence quality.

01

Scenario

A customer assistant retrieves another customer's contract.

02

Scenario

A policy bot summarizes restricted HR material.

03

Scenario

Raw retrieved passages are stored in broadly visible logs.

Business Impact

Why it matters

  • Cross-tenant or cross-role exposure.
  • Compliance risk from excessive context retention.
  • Reduced trust in enterprise knowledge assistants.

Exploit Path

How attackers exploit it

  • Ask broad questions that cross permission boundaries.
  • Induce the agent to reveal source snippets.
  • Exploit weak metadata filters or over-broad service accounts.

Detection and Testing

How to detect and test for rag data leakage.

Detection signals

  • Answers include content the requester cannot access directly.
  • Retrieval traces cross tenant, role, or sensitivity boundaries.
  • Logs retain sensitive context unnecessarily.

Test methods

  • Use role-based test users and canary documents.
  • Verify retrieval permissions before generation.
  • Review response, citation, memory, and log outputs.

Related Topics

Review adjacent failure paths.

Back to Autonomous AI Threat Library

Indirect Prompt Injection

Indirect prompt injection is hidden in content the agent reads later, such as documents, webpages, tickets, emails, repository files, or tool responses.

Explore topic

Memory Poisoning

Memory poisoning occurs when false, malicious, stale, or sensitive information is written into memory and later influences agent behavior.

Explore topic

Audit Gaps

Audit gaps occur when teams cannot reconstruct why an agent acted, which control applied, who owned the decision, or what evidence supports the outcome.

Explore topic