Retrieval-augmented generation

A practical pen-testing guide for generative AI, LLM and RAG applications argues that the security question has shifted from whether a model says something it should not to whether manipulated language can reach protected data or trigger unauthorized business actions. It recommends starting with an architecture walk-through that maps prompts, retrieval, tools, identities and logging, then treating prompt injection as a multi-turn campaign rather than a single-phrase test.

The article argues that Retrieval-Augmented Generation (RAG) gives AI agents in enterprise SaaS real-time access to sensitive company data, which creates serious security liabilities. It cites recent incidents, including the "EchoLeak" zero-click exfiltration from Microsoft 365 Copilot's RAG pipeline in late 2025 and vector database exposures in 2024 to 2025. It then outlines a three-phase RAG pipeline (ingestion and embedding, storage and retrieval, generation and orchestration) and maps threats to each phase.

An opinion-style article argues that by late 2025 enterprise AI had shifted from chat-based LLMs to autonomous agents, driven by the failure of standard RAG systems. It states that 72% to 80% of enterprise RAG implementations underperform or fail within their first year, and that agentic RAG introduces a new risk: autonomous execution of malicious instructions. The source text is cut off before its security analysis.