Orbyntis — Building and Securing Autonomous IntelligenceRequest a Briefing

Untrusted Retrieval

RAG Prompt Injection

Evaluate how malicious retrieved content can influence model behavior, tool calls, approvals, and generated answers. The goal is to make the control boundary visible before the agent operates in production.

A retrieved document inserts an untrusted instruction into a model's context assembly.
Retrieved text is not an instruction.

Definition

What is RAG Prompt Injection?

Evaluate how malicious retrieved content can influence model behavior, tool calls, approvals, and generated answers.

Enterprise AI risk becomes concrete when a connected system can read data, invoke tools, influence approvals, or leave incomplete evidence.

Attack Scenarios

Where this shows up in real agent workflows.

The exact exposure depends on authority, connected systems, identity, approval state, and evidence quality.

01

Scenario

A production workflow relies on rag prompt injection assumptions that were only tested in a pilot.

02

Scenario

A connector, retriever, or tool response changes agent behavior without a clear owner.

03

Scenario

Security and governance teams cannot see where the control is enforced.

Business Impact

Why it matters

  • Unmapped authority can expand the blast radius of a single agent failure.
  • Sensitive data or business actions can move outside intended controls.
  • Approval and audit teams may lack enough evidence to trust the workflow.

Exploit Path

How attackers exploit it

  • Find a weak boundary between untrusted input, retrieved context, identity, and tool authority.
  • Steer the agent toward a capability that is available but not appropriate for the current workflow.
  • Use missing validation or missing evidence to make the unsafe action look routine.

Detection and Testing

How to detect and test for rag prompt injection.

Detection signals

  • Broad scopes, vague tool descriptions, or unclear server ownership.
  • Tool calls or retrieval results that do not match requester authority.
  • Logs that omit context source, policy result, approval state, or owner.

Test methods

  • Map the workflow from request to business effect.
  • Test adversarial prompts, retrieved content, tool parameters, and approval states.
  • Verify controls outside the model and preserve enough evidence for review.