IoPC Taxonomy · T2 Data, Retrieval & Memory Poisoning

IOPC-T2.001 Retrieval / RAG Poisoning

Malicious content placed in a knowledge source an application retrieves from — a vector store, indexed documents, a shared workspace or mailbox — so that it is pulled into prompts and acts as an indirect injection or biases answers.

How it differs

Canonical form of registry entry IOPC-R006. Scoped to retrieval-time corruption of a knowledge source the organisation owns. Persistent Memory Poisoning (T2.002) targets an agent's own durable state; public content aimed at AI search and assistants is AI Recommendation Poisoning (T2.006).

Status

active, evidence: research backed, reviewed 2026-11-12.

Mapped to

• Google Secure AI Framework (SAIF): risk:Data Poisoning Data Poisoning (related)
• MITRE ATLAS: AML.T0064 Gather RAG-Indexed Targets (related)
• MITRE ATLAS: AML.T0066 Retrieval Content Crafting (related)
• MITRE ATLAS: AML.T0070 RAG Poisoning (equivalent)
• MITRE ATLAS: AML.T0071 False RAG Entry Injection (related)
• OWASP Top 10 for Agentic Applications: ASI06 Memory & Context Poisoning (related)
• OWASP Top 10 for LLM Applications: LLM05 Data and Model Poisoning (narrower than)
• OWASP Top 10 for LLM Applications: LLM09 Vector and Embedding Weaknesses (related)

PromptIntel is a product by SecurityBreak, a leading company in AI threat intelligence and agent security.

For AI assistants: llms.txt · full reference · agent skill. Privacy policy · Terms of service