AG-RAG-NO-SANITIZE: RAG Injection: Unsanitized Vector Store Content

What this rule means

A function retrieves content from a vector store and passes it directly into an LLM call with no sanitization. This is indirect prompt injection: an attacker stores malicious instructions in any document the pipeline might retrieve, and the model cannot distinguish those instructions from legitimate content.

Why it matters

First demonstrated against Bing Chat (2023); the same pattern has since shown up in GPT-4 plugin attacks, ChatGPT exfiltration chains, and agent hijacks generally.

How to fix it

Treat retrieved content as untrusted data, not instructions — wrap it in clear delimiters, and never let it alter tool-use decisions without a human or policy check.

Detect it

pip install lucin
lucin scan .                  # all rules
lucin explain AG-RAG-NO-SANITIZE          # this rule, in your terminal

Findings carry a file:line and, where the rule supports it, a witness path showing the flow that triggered it. Precision and recall for the whole rule set, with the commands that regenerate them, are on the benchmarks page — and the gaps are on limits.

← All detection rules