Summary: Six PITAX techniques that attack the stores an AI system reads from — the RAG corpus, the retriever’s ranking, long-term memory, links it follows — so the payload is delivered to a victim’s session the attacker never touches.
Sources: raw/AI-attack-techniques/PIT-T-12,13,32,44,45,64-*.md
Last updated: 2026-07-28
Attacking the retriever, not the model
T64 Retrieval Ranking Manipulation crafts “corpus documents, embeddings, metadata, or trigger phrases so the attacker’s content wins retrieval or re-ranking and reaches the generator’s context. This manipulates the retriever upstream to guarantee delivery, rather than acting on the model after the payload is already in context” (source: PIT-T-64-retrieval-ranking-manipulation-rag-poisoning.md; Topic-FlipRAG arXiv 2502.01386; Poison-RAG).
This is the delivery-guarantee layer. Everything else in the corpus can be neutral until the retriever is persuaded to surface it. It pairs with any in-context technique: T64 gets the payload into the window, T51 Fake Completion makes the model act on it.
Memory as a persistence mechanism
T13 Memory Exploitation covers “exploiting model’s memory and context handling mechanisms” (source: PIT-T-13-memory-exploitation.md), with aliases Memory Poisoning (Microsoft), MINJA / Memory Injection Attack (arXiv 2503.03704), and SpAIware (Rehberger).
Memory converts a one-shot injection into a persistent compromise. Clearing the conversation does not clear it. The CoSAI framework lists memory poisoning among the threats that “don’t fit neatly into conventional security categories” and includes a dedicated MINJA playbook (source: raw/AI-incident-response/Defending AI Systems...md).
Dormancy defeats testing
T44 Conditional / Trigger-Gated Payload stays “dormant and benign until a specific trigger, a date, keyword, user, or matching query, fires, letting it pass safety evaluation and then activate the malicious behavior on demand” (source: PIT-T-44-conditional-trigger-gated-payload-sleeper.md; aliases sleeper agent, logic bomb, MITRE ATLAS AML.T0051.002).
Combined with T64, this is the hard case: a corpus document that scans clean, retrieves reliably, and only activates for the target. Content review of the corpus at ingest time cannot catch it.
Propagation
T45 Prompt Worm — a self-replicating injection that “copies itself into every agent, memory, or RAG store it touches and propagates worm-like across an agent ecosystem, performing malicious actions (spam, exfiltration) at each hop” (source: PIT-T-45-prompt-worm-self-replication.md; Morris II, Cohen et al. arXiv 2403.02817; Prompt Infection arXiv 2410.07283; Infectious Jailbreak / Agent Smith arXiv 2402.08567).
T45 is what makes the other five compound. A poisoned memory store that writes to a shared RAG corpus that other agents read is a propagation graph, not a single incident.
Exfiltration channel
T12 Link Injection — “using links and URLs to inject malicious content or bypass filters,” with aliases markdown image exfiltration, LLM Response Rendering (MITRE ATLAS AML.T0077), and “zero-click data-exfil channel” (source: PIT-T-12-link-injection.md).
This is the standard egress path for everything above: if the client renders markdown images, a retrieved payload can exfiltrate context contents with no user interaction.
Self-reinforcing context
T32 Echo Chamber is listed as both delivery and belongs here as well as in multi-turn-attacks — poisoned framing planted in retrieved content self-reinforces exactly as it does across chat turns (source: PIT-T-32-echo-chamber-context-poisoning.md).
Regulatory and operational hooks
- CoSAI ships CACAO playbooks for “Mitigating RAG poisoning” and “Handling memory injection attacks (MINJA)” (source:
raw/AI-incident-response/Defending AI Systems...md) — see CoSAI AI Incident Response Framework. - Containment for this cluster is architecture-specific: CoSAI frames it as “Should you roll back to a previous model version? Purge poisoned memory? Rebuild your vector database?” (same source).
- AI Act Article 15(5) requires measures against “attacks trying to manipulate the training data set (data poisoning)” — see Article 15.
Documented in the wild
These are not hypothetical. Four production attacks matching this cluster are documented in RAG and runtime poisoning — AgentFlayer (a 300-word payload in a shared Drive file, zero-click), the Microsoft 365 Copilot ASCII-smuggling attack (triggered by background processing of an unopened email), PoisonedRAG, and Nightshade. ATLAS carries a comparable case as AML.CS0037.
Indirect prompt injection also outranks direct injection in ATLAS’s documented case studies (13 vs 12 uses) — see ATLAS case studies.