First reported · updated · 2 reports aclanthology.org
Research · latest
First reported offensai.com
A Security Analysis of Amazon S3 Vectors and Its Use in LLM Retrieval Pipelines
OFFENSAI and TUCN researchers analyzed Amazon S3 Vectors, AWS's native vector store for RAG pipelines, and demonstrated that its metadata is completely unvalidated on write, letting anyone with s3vectors:PutVectors forge chunk text, spoof citation URLs, rank-flood indexes, or overwrite legitimate chunks. In testing, a single planted vector drove a clinical RAG assistant to recommend a dangerous drug dose while citing an authentic PDF, and a poisoned chunk led to command execution in a tool-enabled agent's sandbox, with CloudTrail unable to reconstruct what changed. Details →First reported · updated · 2 reports acm.org
When Context Bites: Detecting RAG Poisoning via Document-Level Attention Collapse | Proceedings of the 49th International ACM SIGIR Conference on Research and Development in Information Retrieval
A SIGIR paper presents SilentRetrieval, a two-stage RAG data-poisoning attack that uses Coordinated Beam Search and Context-Adaptive Trigger Generation to craft fluent, low-perplexity adversarial documents that remain retrievable and hijack answers, achieving up to 84.6% HR@10 and 57.5% ASR-LLM on Natural Questions and MS MARCO, and retaining 74.2% HR@10 at a 0.016% poisoning ratio on a 21M-passage corpus. The work also evaluates combined retrieval- and generation-side defenses (reducing ASR-LLM to ~21-25%) and proposes detection via document-level attention collapse. Details →First reported arxiv.org
When Context Bites: Detecting RAG Poisoning via Document-Level Attention Collapse
Researchers from University of Technology Sydney and collaborators present D-SCAN (Document-level Signal Collapse Analysis), a lightweight framework that detects RAG poisoning attacks by monitoring an internal signature they call 'Attention Collapse'—where a generator's attention entropy decreases and concentrates on injected adversarial documents. The paper shows that output-side signals like perplexity fail because poisoned outputs can exhibit lower perplexity (false confidence), and that D-SCAN can detect attacks even when they do not alter the final answer, with code released on GitHub. Details →First reported arxiv.org
When Safety Becomes a Vulnerability: Exploiting LLM Alignment Homogeneity for Transferable Blocking in RAG
Researchers present TabooRAG, a blocking attack against Retrieval-Augmented Generation systems that exploits what they call 'alignment homogeneity'—shared refusal criteria across safety-aligned LLMs—to craft poisoned documents that cause models to refuse benign queries. Rather than injecting instructions, TabooRAG builds query-relevant risk context in a surrogate environment and transfers it to unknown target systems, achieving state-of-the-art attack success across nine LLMs and three datasets with a 67.3% relative gain over baselines even after prompt-injection filtering. Details →First reported icml.cc
ICML Poster Eyes-on-Me: Scalable RAG Poisoning through Transferable Attention-Steering Attractors
"Eyes-on-Me: Scalable RAG Poisoning through Transferable Attention-Steering Attractors," an ICML 2026 poster by Yen-Shan Chen and colleagues, presents a RAG data-poisoning technique that uses transferable attention-steering "attractors" to manipulate retrieval-augmented generation systems. The abstract is truncated, but the work is framed as a scalable, transferable poisoning attack against RAG pipelines. Details →First reported · updated · 2 reports arxiv.org
DisarmRAG: Stealthy Retriever-Centric Poisoning to Disable Self-Correction in Retrieval-Augmented Generation (Extended Version)
DisarmRAG is a research attack framework that poisons the retriever component of Retrieval-Augmented Generation systems—rather than only the knowledge base—to inject anti-self-correction instructions into the LLM context, suppressing models' self-correction ability and forcing attacker-chosen outputs. Using iterative co-optimization and a contrastive-learning-based stealthy model-editing technique, the authors report success rates exceeding 90% across six LLMs and three QA benchmarks while evading detection defenses. Details →First reported arxiv.org
KidnapRAG: A Black-Box Attack for Hijacking Reasoning in Agentic Retrieval-Augmented Generation Systems
KidnapRAG is a research paper presenting a black-box poisoning attack against Agentic RAG systems in which the attacker only publishes externally retrievable poisoned documents. The method uses three role-specific documents (Bait, Chain-Link, and Mal-Ins) to hijack an agent's multi-step reasoning chain, outperforming existing poisoning baselines across multiple frameworks, LLM backbones, and benchmarks; code is released on GitHub. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector