AML.T0070
RAG Poisoning
Description
Adversaries may inject malicious content into data indexed by a retrieval augmented generation (RAG) system to contaminate a future thread through RAG-based search results. This may be accomplished by placing manipulated documents in a location the RAG indexes (see Gather RAG-Indexed Targets). The content may be targeted such that it would always surface as a search result for a specific user query. The adversary's content may include false or misleading information. It may also include prompt injections with malicious instructions, or false RAG entries.
Honesty-tier rationale
Persistence needs durable tampering with real model weights or infrastructure; the mechanism can be shown, but real persistence cannot be faked in a browser.