A developer has demonstrated how attackers can poison RAG systems by injecting fabricated documents that manipulate AI responses. Using only local tools—LM Studio, Qwen2.5-7B, and ChromaDB—the researcher achieved a 95% success rate in making an AI report false financial data. The attack required just three carefully crafted documents to override legitimate information in a five-document knowledge base.

This isn't theoretical. The lab showed an AI confidently reporting $8.3M revenue instead of the actual $24.7M, complete with fabricated workforce reductions and acquisition talks. The attack exploits two conditions from the PoisonedRAG research: retrieval dominance and generation manipulation. In production systems with hundreds of documents, attackers need more poisoned content, but the mechanism remains effective. Embedding anomaly detection at ingestion proved most effective, reducing success from 95% to 20% as a standalone control.

The danger lies in persistence and invisibility. Poisoned documents stay indefinitely, firing on every relevant query until manually removed. Users never see the source documents—only the authoritative-sounding response. This makes knowledge base poisoning more dangerous than direct prompt injection, as it operates silently while maintaining the illusion of credibility.