Data Exfiltration Risks in Retrieval-Augmented Agents

Retrieval-augmented agents expose sensitive data through more than their answers. Their knowledge bases, retrieved context, model behavior, and tool permissions are linked in a path through which information can leave an organization. Securing that path requires controls matched to each pipeline stage, rather than relying on filters to catch an attack after the agent has already gained access to the data.

Why retrieval-augmented agents create a different attack surface than standalone LLMs

Retrieval-augmented generation, or RAG, connects a model to an external knowledge base through a retrieval mechanism. An agent adds tool use and multi-step autonomy, allowing the system to act on what it retrieves. That changes the security boundary of the system. A prompt-only LLM is exposed through its memorized knowledge and user input, while a retrieval-augmented agent also reaches documents, tools, and APIs. Xu et al.'s RAG security survey frames this distinction around both the content of external knowledge and the access path through which it reaches the model.

Lahjouji and Colaco's data-centric survey explains why these systems lack a single privacy enforcement point. Agents touch heterogeneous sources, pass sensitive information through intermediate artifacts, retain state across sessions, and operate with delegated authority broader than an individual task requires. Protective transformations also create trade-offs between utility and privacy. Retrieval supplies information, but agentic execution can move it across system boundaries. The resulting risks map onto distinct stages, from knowledge ingestion and retrieval to context assembly, tool execution, and output.

The trust asymmetry built into the retrieval pipeline

User queries are usually treated as untrusted input, while retrieved knowledge is often granted implicit authority. Yet both enter the model's prompt, where retrieved data can be followed as instructions. Source approval is not the same as instruction authority. An approved support system, for example, can contain a ticket with hidden commands that the model interprets as system-level instructions. The flaw is the promotion of retrieved content into authority.

A chunk can answer the user's question closely enough to earn retrieval while also directing the agent toward an unauthorized action. Nothing about its usefulness establishes permission to obey it. The boundary must allow the agent to use content as evidence while keeping it from treating that content as a command. Without that boundary, an attacker can steer what the agent does through material the legitimate user never wrote or reviewed.

Xu et al. show how this risk arises through knowledge poisoning, retrieval manipulation, context exploitation, and knowledge extraction. Their survey also identifies uneven defenses across these stages, with knowledge-base and retrieval controls comparatively underdeveloped relative to downstream protections. The imbalance leaves earlier decisions insufficiently constrained. Once sensitive or malicious content has entered the prompt, an output filter must compensate for decisions already made about what the agent may read and trust.

How knowledge-base poisoning turns the corpus itself into the attack vector

Knowledge-base poisoning exploits that trust gap before a user submits a query. An attacker needs an ingestible channel, such as a public forum or support ticket, rather than access to model weights or application code. The corpus becomes an active attack surface. A malicious document that closely matches a target question can be selected by the retriever and steer the model toward the attacker's desired answer. In this setting, semantic relevance helps deliver the payload.

PoisonedRAG demonstrated this mechanism at USENIX Security 2025. The research injected a small number of malicious texts per target question into a knowledge base containing millions of documents and achieved a high attack success rate. It worked in fully black-box settings with no model-weight access. The attacker needs influence over what a particular query retrieves.

Mandiant documented a related vulnerability during a 2026 security evaluation of an enterprise organization. Hidden malicious instructions could be placed in a public forum comment and a customer support ticket, then retrieved during legitimate inquiries. The agent interpreted the embedded instructions as system-level commands. That behavior could potentially expose sensitive data from other customers' support tickets. Corpus poisoning was the entry point, while the attempted change in behavior occurred when the retrieved material reached the model.

Indirect prompt injection at inference time: three delivery methods that reach production systems

The Mandiant case illustrates the handoff from stored malicious content to runtime instruction following. Persistent write access to a knowledge base is not required for this broader class of attack. Any external content the agent reads can supply instructions.

Rendered-output exfiltration places sensitive context inside a URL that the agent includes in an image or link. An automatically fetched image can transmit that information without further user action, while a link may require a click. Tool chaining instead redirects capabilities the agent already holds, such as sending mail or writing to a shared drive. The request uses legitimate permissions for an illegitimate purpose. Multi-turn conditioning distributes steering across benign-looking interactions so that no single message presents an obvious attack.

Aim Security disclosed EchoLeak in June 2025 as the first documented case of prompt injection weaponized for concrete data exfiltration in a production AI system. EchoLeak, identified as CVE-2025-32711 with CVSS 9.3, used a single crafted email to make Microsoft 365 Copilot access internal files and send their contents to an attacker-controlled server without user interaction. The exploit chained four bypasses. It evaded Microsoft's XPIA classifier, circumvented link redaction through reference-style Markdown, exploited auto-fetched images, and abused a Microsoft Teams proxy.

The August 2024 Slack AI incident showed a similar pattern with content from private channels. Indirect injection caused the AI to summarize sensitive conversations and render links that passed private data to an attacker-controlled address when clicked. That interaction requirement distinguishes it from EchoLeak's automatic exfiltration. Zhang and Pei's Back-Reveal research shows how the runtime risk spans multiple turns, as attacker-controlled retrieval responses can steer what the agent and user do later.

Backdoored tool use as a supply-chain exfiltration channel

Back-Reveal also exposes a threat below the retrieved-content layer. Zhang and Pei embed semantic triggers into fine-tuned agents, so that a domain-specific query activates malicious behavior learned before deployment. Clean runtime content is not enough in this case. The triggered agent uses memory-access tools to collect stored user context and transmits it through retrieval calls to an attacker-controlled server posing as a benign knowledge source. The legitimate retrieval tool becomes the exfiltration channel.

That channel is difficult to distinguish from ordinary work because retrieval tools often have broad outbound access and routinely issue HTTP requests to documentation sources or search APIs. The malicious request uses the same mechanism. Back-Reveal's reranker-aware rewriter also produces highly relevant retrieval responses containing implicit steering cues recognizable to the backdoored model. Those responses can sustain multi-turn steering while bypassing rerankers, prompt-injection detectors, and content filters designed to catch overt instructions.

Organizations that use open-source or third-party fine-tuned models can take on compromised behavior built into the model itself. No poisoned document has to explain the malicious action. Content defenses may find the text acceptable while the agent moves private information with tools it is allowed to use. This makes tool scope and outbound controls essential even when ingestion and prompt inspection find nothing suspicious.

Privilege escalation and the access-control gap in agentic deployments

Excessive agent permissions amplify every attack described above. When an agent can retrieve more than the user it represents, a successful injection or backdoor can expose information that the user could never access directly. Strong perimeter controls do not resolve that mismatch. An employee's answer should draw only from data that employee is authorized to read. Access-control lists must therefore constrain retrieval itself, rather than exist only in the surrounding application.

The same requirement applies to delegated action. A relationship manager who cannot access another team's client records should not gain that access through an agent. When multiple customers' embeddings occupy the same vector database, retrieval without tenant-aware filtering can return one customer's documents in response to another customer's query. The relevant scope is the user's authorized data within the correct tenant.

ALDEN shows the extraction risk when retrieval access is not adequately constrained. The research uses active learning to diversify malicious queries and estimates the knowledge base's topic distribution to guide further query generation. Viewed through access control, the implication is that unconstrained retrieval can support repeated probing across a corpus. Permissions determine how much data an effective extraction strategy can reach.

Why the standard filter-first defense posture is necessary but not sufficient

Securing AI Agents Against Prompt Injection Attacks reports a 79.6% baseline success rate for data exfiltration attacks and finds substantial overall improvement from combining full-stack content filtering, hierarchical guardrails, and multi-stage response verification. Most baseline task performance was preserved. However, the benchmark result has not yet been validated in production deployments.

Xu et al.'s survey identifies a signal mismatch in which fluent, retrievable, corpus-fitting attacks challenge anomaly-based defenses by design. Back-Reveal targets the same weakness with responses that score well on relevance reranking while embedding cues for a compromised model. A defense optimized to reject irrelevant or explicit instructions is not necessarily equipped to recognize that behavior.

The UK NCSC has stated that this class of attack may never be fully fixed. That warning changes the role filters should occupy. If a classifier misses an injection, retrieval permissions should still limit what can be read, and tool controls should still limit where information can go. Those upstream constraints are the basis for a pipeline-wide defense.

Defense strategies matched to each layer of the RAG agent pipeline

At ingestion, integrity and provenance controls address poisoning before malicious material can earn a place in retrieved context. Source verification before ingestion, document signing, and audit trails for newly introduced or modified chunks make changes to the knowledge base subject to scrutiny. Approval must not become permanent trust in content. These controls govern entry into the corpus, while later controls govern how that content can influence an agent.

At retrieval, access-control lists belong at the vector-database query level, with tenant-aware filtering for shared deployments. Rerankers should penalize off-topic or instruction-rich chunks alongside rewarding semantic similarity. Context assembly requires a separate trust boundary. Retrieved chunks should go through prompt-injection detection before they reach the model, and prompt templates should keep instructions and retrieved content in separate parts of their structure. Even material from an approved knowledge base remains untrusted as a source of commands.

At the tool layer, least-privilege scoping limits agents to the permissions required for their current task. Mapping which tools an agent can use makes its delegated authority clear, and circuit breakers can cut off access when it goes over token budgets or tries to make unauthorized API calls. Output checks serve a different purpose. Response verification against the user's authorization scope and redaction of retrieved PII restrict disclosure, while outbound monitoring flags retrieval calls to domains outside an approved allowlist. That last control adds coverage of the retrieval channel exploited by Back-Reveal to final-answer checks.

The NIST AI Risk Management Framework, version 1.0 from January 2023, is a reference for governance, and groups such as the Cloud Security Alliance have proposed third-party agentic profiles. Lahjouji and Colaco identify information-flow control as the only governance mechanism covering both compositional and cross-session inference leakage because it tracks provenance throughout execution. Organizations prepared for retrieval-augmented agents govern what information enters, who can retrieve it, how it shapes actions, and where it can leave, rather than treating the final response as the sole security boundary.