# RAG security: prompt injection, memory and tenant isolation

> Assess RAG security across hostile documents, persistent memory, permissions, caches and tools. Defensive test cases with expected evidence.

Published: 2026-11-04  
Canonical: https://rootzero.eu/en/research/rag-security-injection-memory/

A retrieved passage is external data even when it resembles an instruction to the assistant. Risk arises when that content changes behaviour, causes unauthorised access or influences a tool action. Accurately quoting a document does not establish that its content is safe.

[OWASP’s RAG guidance](https://cheatsheetseries.owasp.org/cheatsheets/RAG_Security_Cheat_Sheet.html) covers the pipeline’s security surface. Below we propose defensive checks for an authorised demonstration environment. They complement the [architecture guide](/en/research/enterprise-rag-architecture-access-evaluation/) and do not report a test of SpectrAI.

## Follow data towards an effect

Identify who can publish, modify and approve each source. Trace extraction, indexing, context inclusion and available tools. Internal content can also be compromised or quote hostile text.

Keep data and instructions distinguishable in the application. Delimiters help representation but are not an authorisation boundary. Tools must still validate parameters and caller permissions independently of the model’s explanation.

## Enforce access before generation

Do not send forbidden customer documents to a model and rely on it to omit citations. Examine reranking, traces and caches too: they may receive passages before final-answer filtering.

For a cross-tenant test, place a fictional marker in workspace B and query from A. Inspect candidates, outgoing context and tool output rather than only the interface. A marker is evidence for that case; its absence from one answer cannot establish the absence of every disclosure.

## Prevent untrusted content becoming durable authority

An external instruction might be summarised and later stored as a preference or rule, losing its origin along the way. A later session may appear to apply internal policy while actually reusing external content.

Preserve provenance and candidate status for memory writes. Define promotion controls and information that must never become shared rules. After source withdrawal, locate derivatives and test a fresh session.

| Demonstration case | Expected outcome | Evidence |
| --- | --- | --- |
| Another customer’s document | No out-of-scope passage transmitted | Access decision and outgoing context |
| Document requests a prohibited action | Tool refuses the unauthorised effect | Parameters, identity and refusal receipt |
| Summary repeats an external instruction | Origin does not become authorisation | Memory state before and after |
| Source withdrawn or permission revoked | Derivatives cannot restore access | Index, cache and subsequent consultation |
| Control service unavailable | Sensitive work does not continue without a decision | Blocked state and absence of effect |

Adapt these expectations to the actual service contract. A phrase blacklist cannot capture every hostile formulation and may also flag legitimate documentation.

## Interpret the local example correctly

The [downloadable program](/lab/rag-demo/rag-demo.zip) rejects missing access metadata, a superseded revision and an unapproved entry. Its `approved` flag comes from the fixture. It does not detect injections in text; an approved document could contain one.

Its ten cases check deterministic selection rules. Testing generation and tool use requires a different experiment. [AgentDojo](https://arxiv.org/abs/2406.13352) provides a research environment for injections in tool-returned data; its protocol and results are not guarantees for another service.

Pair hostile tests with legitimate tasks. A defence that refuses all reading may prevent an incident while making the service unusable. The [evaluation guide](/en/research/evaluating-cyber-ai-agents-evidence-metrics/) preserves that distinction. Find the other layers in the [AI and security series](/en/ai-security-guides/).