The AI Memory Security Blueprint

Designing Context Isolation, Retrieval Trust, and Vector Database Governance for Enterprise RAG Systems

Part 1 — Five Documents Can Hijack a Frontier Model

Here's a number worth sitting with before anything else in this piece: researchers demonstrated that injecting just five malicious documents into a knowledge base of 2.6 million texts could control a frontier LLM's output 97% of the time. The attacker never touches the model weights. They never see the retriever's code. They just write a document and wait for it to get indexed. That's PoisonedRAG, accepted at USENIX Security 2025, and it's the paper that should have ended the "just add RAG for accuracy" conversation as a purely upside decision (USENIX Security 2025 / arXiv:2402.07867). 

Follow-on research made the picture worse, not better. A January 2026 paper introduced CorruptRAG, which achieves a comparably high attack success rate using a single poisoned document instead of five — a meaningfully more realistic threat model, since most real corpora don't let an attacker casually drop five coordinated files without anyone noticing. Separately, researchers found that poisoning as little as 0.04% of a corpus could push attack success rates above 98%, with system failure in nearly three-quarters of cases (Medium/InstaTunnel, citing 2025–2026 RAG poisoning research).