AI Data Poisoning: RAG, LLM & Multi-Agent Security

Data Poisoning in AI: Attack Surfaces & Attack Types in Multi-Agent Systems 

The Slack AI data exfiltration incident (August 2024), PoisonedRAG research presented at USENIX Security 2025, and Unit 42’s agent session smuggling findings all point to a critical shift in AI security risks. These cases highlight how data poisoning in AI systems is no longer limited to model training—it now impacts real-time decision-making inside multi-agent environments. 

Today, the security boundary has moved beyond traditional infrastructure. It now exists inside vector databases, retrieval systems (RAG), agent memory, and tool integrations—areas that most enterprise security frameworks are not fully equipped to monitor. 

Understanding the Attack Surface in AI Systems 

In modern enterprise environments, especially those using multi-agent systems (MAS), AI attack surfaces have expanded significantly.  

The diagram below maps these surfaces against a typical orchestrator-plus-agents architecture 

Data poisoning can enter the system through six key points: 

• Data Sources (Entry Point for Prompt Injection Attacks)

This is where external and internal data enters the system—web content, vendor documents, APIs, and user uploads. 

It is also the primary layer for prompt injection attacks, where malicious instructions are hidden within legitimate-looking content.
A well-known example is the Slack AI incident, where poisoned inputs triggered unintended data exposure. 

• Retrieval Corpus (RAG & Vector Database Security Risks)

Retrieval-Augmented Generation (RAG) systems rely on vector databases to fetch relevant information. 

Research like PoisonedRAG shows that inserting just a few malicious entries can manipulate outputs—even in massive datasets. 

This highlights a major concern in vector database security: 

• Attackers need minimal effort  

• Defenders must secure massive datasets  

• Agent Memory (Persistent AI Vulnerabilities)

Agent memory stores information across sessions, making it a high-risk component. 

Attacks like AgentPoison and MINJA demonstrate how agent memory poisoning can: 

• Persist over time  

• Influence future outputs  

• Bypass traditional safeguards  

Unlike prompt injection, this is not temporary—it becomes a long-term compromise. 

• External Tools & APIs (AI Supply Chain Attacks)

Agents frequently interact with external tools, APIs, and MCP servers. 

This creates multiple risks: 

• Malicious tool descriptions  

• API response manipulation  

• Tool shadowing attacks  

These fall under broader AI supply chain attacks, where trust in external integrations becomes a vulnerability. 

• Model Updates & Training Data (Machine Learning Data Poisoning)

One of the most critical layers is the training pipeline. 

Studies show: 

• As few as 250 poisoned samples can backdoor large models  

• Even 0.001% corrupted data can influence outcomes  

This reinforces the growing threat of machine learning data poisoning in enterprise AI. 

• Feedback Loops (AI Feedback Loop Attacks)

User feedback, ratings, and reinforcement learning signals can also be exploited. 

Research shows that malicious inputs can: 

• Spread across agents  

• Trigger AI agent privilege escalation  

• Create self-propagating attacks  

Types of Data Poisoning Attacks in AI 

The six surfaces describe where poisoning enters the system; four functional types describe what the attacker is trying to achieve. Any surface can be exploited to produce any of these effects — the surfaces and types are independent dimensions. 

• Availability Attacks

These degrade system performance or cause failures. 

• Example: 
• Models generating unusable or irrelevant outputs  

• Integrity Attacks

These manipulate outputs for specific inputs. 

Example: 

• Biased or incorrect responses in critical domains like healthcare  

• Backdoor Attacks

These introduce hidden triggers that activate malicious behavior. 

• The model behaves normally  

• But fails when a trigger is present  

• Context (RAG) Poisoning

This targets retrieval systems instead of the model itself. 

• Injected content influences responses at runtime  

• No need to modify the model  

What This Means for Enterprise AI Security 

The combination of these attack surfaces and attack types reveals three major realities: 

• Traditional Security Models Are No Longer Enough

Security must now extend to: 

• Vector databases  

• Agent memory  

• Tool ecosystems  

• Attackers Have an Economic Advantage

A handful of malicious inputs can compromise systems built on millions of data points. 

• Data is Now Executable

In AI systems, data is no longer passive—it acts as instructions. 

This is the core reason why AI data poisoning attacks are so dangerous. 

Conclusion: Securing Multi-Agent Systems Against Data Poisoning 

The biggest takeaway is clear: 

The model itself is not the main risk—the ecosystem around it is. 

To protect against data poisoning in AI, organizations must: 

• Secure data pipelines before ingestion  

• Monitor RAG systems and vector databases  

• Validate external tools and APIs  

• Implement memory and feedback safeguards  

As AI adoption grows, multi-agent system security will become a top priority for enterprises.