Engineering · 6 min read · April 19, 2026
Indirect Prompt Injection Turns RAG Documents Into Attack Vectors
Malicious instructions hidden inside ingested PDFs can override LLM system prompts before any chat-layer firewall ever sees them.
Untrusted documents fed into RAG pipelines can carry hidden instructions that hijack LLM behavior at retrieval time, bypassing all conventional security tooling.
- — RAG pipelines ingest untrusted documents and store their text as searchable vectors.
- — Attackers embed hidden text in PDFs using zero-font or white-on-white techniques.
- — PDF parsers extract raw text regardless of visual formatting, capturing hidden payloads.
- — Retrieved chunks land in the LLM context window alongside the system prompt.
- — Transformers lack hardware-level separation between instructions and data, so injected text executes.
- — Standard DevSecOps tools scan infrastructure code but ignore AI data artifacts entirely.
- — Defense must occur at ingestion: Unicode normalization, de-obfuscation, and semantic ML classifiers.
- — Open-source tool Veritensor wraps LangChain loaders to block payloads before vectorization.
Frequently asked
- Indirect prompt injection occurs when malicious instructions are embedded inside documents that a RAG pipeline ingests, such as PDFs or HTML pages. When those documents are retrieved and placed into an LLM's context window, the model may interpret the embedded instructions as legitimate commands, overriding its original system prompt. Unlike direct prompt injection through a chat interface, this attack arrives through the data supply chain and leaves no suspicious user query in the logs.