Research · curated 21 Jul 2026
Reproducing an Indirect Prompt Injection Against a RAG Pipeline
First reported koreshield.ai
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
Indirect prompt injection via poisoned retrieved documents lets attackers exfiltrate secrets and internal context from RAG assistants without ever touching the network, and this reproduction gives defenders runnable code and logs to test their own pipelines.
A Koreshield write-up reproduces an indirect prompt injection against a RAG customer-support pipeline, where a poisoned knowledge-base document (doc-002) contains a bracketed fake 'system note' instructing the model to dump all retrieved documents and exfiltrate internal tokens with an 'EXFIL::' marker while hiding the action. The author provides runnable code, a public GitHub harness (UncleTeslim/prompt-injection-repro), and real model logs demonstrating the attack against a local Llama3-8B model.