Retrieval-augmented generation became the default architecture for enterprise AI applications through 2024 and 2025. By 2026, the predicted attack class — RAG poisoning, where attackers plant content in indexed sources to manipulate AI behaviour — has moved from academic research to production incidents. The pattern is consistent enough to call a trend.
What RAG poisoning looks like in production
Three observed variants:
- Document insertion. Attacker plants a malicious document in a shared knowledge base that the RAG indexes. When the AI retrieves it, the embedded instructions run.
- Wiki-style edits. Attacker edits an internal wiki page that the RAG uses. Subtle changes produce subtle behaviour changes.
- Partner-content compromise. Attacker compromises a partner's content that is syndicated into the RAG. Widest blast radius; hardest to detect.
Each has appeared in incident reports through 2025-2026.
Why traditional controls miss it
Two structural reasons:
- DLP doesn't see it. The payload is in a document, not in a data field.
- Content review doesn't catch it. The instructions are designed to look like legitimate content.
Detection requires AI-specific controls.
Defences that work
Four layers:
- Source attribution. Every retrieved chunk carries a source identifier. Outputs cite sources.
- Ingest governance. Not every source is indexable; the index has a curated provenance.
- Retrieval anomaly detection. Unusual retrieval patterns — a chunk that hadn't been retrieved before, suddenly being retrieved often — get reviewed.
- Capability scoping. Even if the AI is influenced, the actions it can take are bounded.
Griffin AI's architecture includes all four for customers using the RAG-adjacent workflows.
What to expect next
Three trends likely:
- Automation of the attack. Tools for generating poisoning payloads will appear.
- Targeted variants. Attacks specifically targeting common enterprise RAG patterns.
- Regulatory attention. EU AI Act Article 10 data governance provisions apply.
How Safeguard Helps
Safeguard's RAG-relevant workflows include ingest governance, source attribution, retrieval anomaly detection, and capability scoping. Customers deploying RAG-adjacent features inherit these controls. For organisations whose AI deployments are graduating from POCs to production, the defensive infrastructure matters.