// GLOSSARY -- AI AGENT SECURITY

What is RAG Knowledge Poisoning?

1 min read Updated

A cognitive state attack that injects fabricated statements into retrieval corpora so agents treat attacker-authored content as verified fact, corrupting downstream reasoning and decisions.

WHY IT MATTERS

RAG-powered agents trust their retrieval corpus as a source of truth. If an attacker can insert content into that corpus — through compromised documents, poisoned web pages, or manipulated knowledge bases — the agent will retrieve and act on false information.

The attack is effective because RAG retrieval feels authoritative. The agent doesn't distinguish between legitimate knowledge and injected content — both arrive through the same retrieval pipeline.

PolicyLayer puts a deterministic check in front of every tool call — the enforcement layer this page assumes.

GOVERN YOUR MCP SERVERS →

Enforced before the call runs. Nothing to install.

HOW POLICYLAYER USES THIS

PolicyLayer's policy enforcement catches the downstream effects of RAG poisoning. Even if an agent's knowledge is corrupted, the tool calls it makes are still evaluated against deterministic rules.

See the MCP Security reference →

FREQUENTLY ASKED QUESTIONS

How is content injected into RAG corpora?
Through compromised documents in shared drives, poisoned web pages that get crawled, manipulated internal wikis, or even adversarial content in email threads that get indexed.
Can RAG poisoning be detected?
It's difficult. The injected content is designed to look legitimate. Detection requires provenance tracking and cross-referencing against trusted sources — an active research area.

FURTHER READING

// THE REGISTRY

Every MCP server your agents touch has a registry record.

Type a name, get the breakdown: verified identity, auth posture, risk grade, every tool classified, recommended policy. Re-checked continuously.

Teams ship this data inside their own products. See what a licence covers →

Take your agents live. Without losing control.

Route your MCP traffic through PolicyLayer. Every tool call is checked against your policy before it runs: allow, deny, or require approval. Per-identity grants. Full audit log. Live in minutes.

GOVERN YOUR MCP SERVERS →

Instant setup, no code required.

46,500+ MCP servers and 515,000+ tools scanned and risk-classified.

// GET IN TOUCH

Have a question or want to learn more? Send us a message.

Message sent.

We'll get back to you soon.