testing-rag-and-memory-poisoning

# Testing RAG and memory poisoning: attacking the knowledge, not the prompt Prompt injection attacks the input at request time. Poisoning attacks the knowledge *before* the request, so the malicious content is already inside the trusted context when retrieval pulls it. Because retrieved chunks and remembered facts are treated as ground truth, a poisoned store is an injection that fires on a legitimate query, from a user who did nothing wrong. The trap is set once and sprung by the victim. ## When to use - You are reviewing a RAG pipeline, a vector store, or any retrieval-augmented assistant. - The agent has persistent or long-term memory written across sessions. - The agent queries live search or web results at runtime and treats them as context. ## Scope check Test stores and pipelines you own or are authorized to test. Use benign, marked content and canaries; never plant real malicious instructions in a shared store. If you can't name the authorization, stop. ## The loop 1. **Map every write path into retrievable knowledge.** List how content enters each store the agent reads: who can add documents to the corpus, who influences what the crawler or indexer ingests, what writes to the agent's memory (the agent itself, users, tool outputs), and which live sources it queries at runtime. Every writer is a potential poisoner. 2. **Check whether ingestion is authenticated and bounded.** Can an unprivileged or external party add or edit a document that wi...