Research
RAG Pitfalls, Security, and Prompt Injection Defense — The Threat Landscape
Publication date unknown · Discovered dataquest.io
Page published
Publication date unknown · First observed: 10 Nov 2026
Coverage timeline
Single-source research — one report is available.
Why it matters
Dataquest's GitQuest examples illustrate why RAG defenses need source-trust handling and destructive-command warnings rather than relying solely on detecting overtly hostile instructions.
Dataquest's GitQuest lesson demonstrates three RAG failure modes: prompt injection through retrieved documents, conflicting source guidance, and destructive Git advice without warnings. The walkthrough presents representative test cases and reports that GPT-4o-mini followed trusted evidence while GPT-4.1-nano failed a prior injection test.