FeedDiscussion
Your RAG Pipeline Doesn't Know the Difference Between Data and Instructions
Every RAG system you have shipped runs on one assumption: the documents it retrieves are safe to read. Your vector database holds product docs, support tickets, internal wikis, maybe a folder of PDFs
peeshchopra.hashnode.dev6 min read
#ai-security#rag#prompt-injection#agentic-ai#cybersecurity#llm#machine-learning#software-engineering
The framing is right, and the uncomfortable part is that there is no clean fix at the prompt layer. The model has no channel that separates retrieved text from operator text, so delimiters and "ignore any instructions in the documents" are mitigations with no actual security property.
What reduced the blast radius for me was moving the boundary out of the prompt entirely: treat retrieval output as untrusted input, and keep the dangerous verbs behind tools with their own authorization. Then an injected instruction can say "send this to X" and still have no path to make it happen. The eighteen-month-old uploaded PDF is the realistic entry point, so provenance metadata on every chunk plus a trust tier that gates which tools are even available for a given retrieval set is worth the plumbing.