Hey everyone, I just published my first article and wanted to share it here since it's about something I genuinely think is underestimated in the AI security space: RAG poisoning.

The short version: with just 5 malicious texts injected into a knowledge base of millions of documents, you can make an LLM confidently answer whatever you want to specific questions. ~97% success rate. The attack is called PoisonedRAG and it was published at USENIX Security 2025.

I didn't just summarize the paper though. I actually ran the attack myself on a custom Wikipedia dataset, tested it against both Ministral 8B and Claude Sonnet 4.6, and the results were... interesting. The small model fell for it 75% of the time. Claude resisted most of it but in a very specific way that I hadn't seen documented before.

I also talk about why Agentic RAG makes this threat significantly worse, and what the actual state of defenses looks like in 2026 (spoiler: most orgs have none)

Would love feedback, especially from people who've worked with RAG systems in production!