KidnapRAG A Black-Box Attack for Hijacking Reasoning in Agentic Retrieval-Augmented Generation Systems

Jul 16, 2026

Upload by Himbo

Retrieval-Augmented Generation (RAG) systems are susceptible to poisoning attacks that insert malicious documents into retrieval to steer model outputs. Agentic RAG mitigates these threats by iteratively retrieving and reasoning, often discarding weakly related poisons and preserving the user-induced reasoning chain. Existing Agentic RAG attacks typically require white-box access to prompts, traces, retrievers, or parameters. KidnapRAG studies black-box poisoning where attackers can only publish externally retrievable documents, using Bait, Chain-Link, and Mal-Ins to sequentially hijack multistep reasoning and evidence, validated across multiple frameworks and benchmarks.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages24

Reading Time1 h 0 min

Introduction

Retrieval-Augmented Generation and poisoning risk

Agentic RAG attack surface and limitations of prior attacks

Proposed black-box threat model for KidnapRAG

KidnapRAG: sequential hijacking mechanism

Bait document: initial retrieval attraction

Chain-Link document: sustaining the hijacked chain

Mal-Ins document: attacker-controlled evidence

Evaluation and results

KidnapRAG: A Black-Box Attack for Hijacking Reasoning in Agentic Retrieval-Augmented Generation Systems Chanwoo Choi 1 ,† Euntae Kim 1 ,† Kyuho Lee 1 ,† Youngsam Chun2 Jinhee Jeong2 Eunmi Kim2 Myunggyo Oh2 Junseo Jang2 Buru Chang 1 ,∗ 1 Korea University 2 KT Corporation {ccw316,untae0122,kyuholee,[buru_chang}@korea.ac.kr](buru_chang}@korea.ac.kr)[ ](buru_chang}@korea.ac.kr){ys.chun,jini.jeong,[em.kim](em.kim),mg .oh,[junseo.jang}@kt.com](junseo.jang}@kt.com) arXiv :2607 .00422v 1 [ cs .CR] 1 Jul 2026 Abstract Retrieval-Augmented Generation (RAG) systems are vulnerable to poisoning attacks that inject malicious documents into the retrieval process to manipulate model outputs. Recent Agentic RAG systems are more robust to such attacks because they iteratively perform retrieval and reasoning, allowing them to ignore weakly relevant poisoned documents and preserve the reasoning chain induced by the user query. However, existing attacks on Agentic RAG systems often assume white-box access to system prompts, reasoning traces, retrievers, or model parameters, limiting their applicability in realistic settings. In this paper, we study black-box poisoning attacks against Agentic RAG systems, where the attacker can only publish externally retrievable poisoned documents. We propose KidnapRAG, a sequential poisoning attack that hijacks the agent’s multistep reasoning chain using three role-specific documents: Bait, Chain-Link, and Mal-Ins, which attract initial retrieval, induce query reformulation, and provide attacker-controlled evidence, respectively. Experiments across multiple Agentic RAG frameworks, LLM backbones, and benchmarks show that KidnapRAG consistently outperforms existing poisoning baselines under black-box conditions. Further analyses show that KidnapRAG progressively weakens the original retrieval intent, redirects retrieval behavior, and increases reliance on attacker-controlled evidence. Our code is publicly available at [https://github.com/](https://github.com/)[ ](https://github.com/)chanwoochoi316/KidnapRAG. 1 Introduction Retrieval-Augmented Generation (RAG) systems (Lewis et al., 2020 ; Izacard and Grave, 2021) have become a standard paradigm for augmenting Large Language Models (LLMs) with external knowledge. However, their reliance on retrieved †Equal contribution. * Corresponding author. Figure 1: Comparison between previous attacks and KidnapRAG in Agentic RAG systems. Previous attacks fail because they cannot hijack the agent’s reasoning chain, whereas KidnapRAG controls the reasoning chain to induce the attacker-intended target answer. documents introduces a critical security risk: adversaries can inject poisoned documents into the retrieval corpus to manipulate model outputs (Choi et al., 2025 ; Chen et al., 2025) . Prior RAG poisoning attacks have shown that conventional RAG systems are vulnerable to such threats, as they typically perform retrieval once and generate responses directly from the retrieved evidence. Recent Agentic RAG systems (Yao et al., 2022 ; Li et al., 2025, 2026 ; Dong et al., 2026) change this attack surface. Unlike conventional RAG, Agentic RAG iteratively performs retrieval, observation, reasoning, and action, enabling follow-up searches and multi-step refinement. This design supports complex information needs and has been adopted in advanced RAG services such as Deep Research in ChatGPT and Gemini. However, it also makes existing black-box RAG poisoning attacks less effective. As illustrated in Figure 1, a poisoned document retrieved at an intermediate step does not necessarily determine the final response. Because the agent can compare retrieved evidence with its current reasoning state, discard weakly relevant information, and continue searching, poisoned documents designed for single-step RAG often fail to alter the reasoning chain induced by the user query. Figure 2: Exposed reasoning processes in real-world Agentic RAG systems. The systems reveal int

FAQs

What makes Agentic RAG systems more robust than conventional RAG against poisoning attacks?

Agentic RAG iteratively performs retrieval, observation, reasoning, and actions, allowing it to compare retrieved evidence with its current reasoning state, discard weakly relevant information, and continue searching. This can prevent single-step poisoned documents from determining the final response.

What is the black-box attacker capability assumed in KidnapRAG?

The attacker can only publish externally retrievable poisoned documents to sources that the agent may be indexed and retrieved from. No access is assumed to system prompts, reasoning traces, retrievers, parameters, or internal policies.

How does KidnapRAG hijack the agent’s reasoning chain?

KidnapRAG uses three role-specific documents—Bait, Chain-Link, and Mal-Ins—to progressively redirect retrieval intent across multiple reasoning steps. Bait induces follow-up queries into a rare domain, Chain-Link sustains the hijacked multistep reasoning during subsequent searches, and Mal-Ins provides attacker-controlled evidence.

Jul 16, 2026

Upload by Himbo