What fails
Retrieval poisoning happens when the model receives bad context and treats it as useful context.
That content may be malicious, stale, low-quality, unauthorized, misleading, or written for a different audience. In a RAG system, retrieval quality is not only an accuracy issue. It is a security issue.
The model is only as safe as the context it is asked to trust.
How it shows up
A document includes hidden instructions. A stale policy is retrieved over a current one. A public source influences an internal answer. A low-trust page is treated like an authority. A poisoned support ticket changes the assistant's recommendation. A retrieved snippet includes sensitive data that should not have been in scope.
The model did not invent the failure. The retrieval layer supplied it.
Why teams miss it
Teams optimize retrieval for relevance before trust.
They tune chunking, embeddings, ranking, and answer quality. But they may not classify sources by authority, freshness, sensitivity, tenant, user access, or instruction risk.
Relevance without trust is dangerous.
Business impact
Retrieval poisoning can affect customer answers, internal workflows, legal guidance, security operations, recruiting decisions, product support, and enterprise trust.
A buyer may ask whether retrieved content can manipulate the AI system.
That question deserves a real answer.
Controls that matter
Useful controls include source trust tiers, freshness checks, authorization-preserving retrieval, content hygiene, injection testing, source attribution, retrieval logs, and separation between informational content and behavioral instruction.
The system should know what it retrieved and why.
What good looks like
Good looks like retrieval that respects authority, not just similarity.
The model should cite sources, avoid treating untrusted text as instruction, and keep sensitive or unauthorized content out of context.
Recommended next step
Run an AI Product Security Assessment for RAG-heavy products.
Use Agentic Workflow Hardening when poisoned retrieval can influence actions.