Research
Reproducing an Indirect Prompt Injection Against a RAG Pipeline
Publication date not yet evaluated · Added koreshield.ai
Page published
Coverage timeline
Single-source research — one report is available.
Why it matters
Indirect prompt injection via poisoned retrieved documents lets attackers exfiltrate secrets and internal context from RAG assistants without ever touching the network, and this reproduction gives defenders runnable code and logs to test their own pipelines.
A Koreshield write-up reproduces an indirect prompt injection against a RAG customer-support pipeline, where a poisoned knowledge-base document (doc-002) contains a bracketed fake 'system note' instructing the model to dump all retrieved documents and exfiltrate internal tokens with an 'EXFIL::' marker while hiding the action. The author provides runnable code, a public GitHub harness (UncleTeslim/prompt-injection-repro), and real model logs demonstrating the attack against a local Llama3-8B model.