--- title: Onboarding Agent from Scratch. Part 8: When Retrieved... description: Part 8 of a series building an onboarding agent from scratch, focusing on indirect prompt injection vulnerabilities in RAG-based systems. When a knowledge base... canonical: https://daily.dev/posts/onboarding-agent-from-scratch-part-8-when-retrieved-documents-start-giving-orders-mwwnzdfiu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Onboarding Agent from Scratch. Part 8: When Retrieved Documents Start Giving Orders | daily.dev og:description: Part 8 of a series building an onboarding agent from scratch, focusing on indirect prompt injection vulnerabilities in RAG-based systems. When a knowledge base... og:url: https://daily.dev/posts/onboarding-agent-from-scratch-part-8-when-retrieved-documents-start-giving-orders-mwwnzdfiu og:image: https://api.daily.dev/og/posts/mWwNZDfIu.png og:image:alt: Onboarding Agent from Scratch. Part 8: When Retrieved Documents Start Giving Orders og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Onboarding Agent from Scratch. Part 8: When Retrieved Documents Start Giving Orders **[Medium](https://daily.dev/sources/medium_js)** · 7 min read · 1 upvotes · 0 comments ## Summary Part 8 of a series building an onboarding agent from scratch, focusing on indirect prompt injection vulnerabilities in RAG-based systems. When a knowledge base can be edited by untrusted parties, malicious instructions planted in documents can be retrieved and acted upon by the LLM — especially dangerous when the agent has real-world tools like Slack notifications. Two live injection tests (one blunt, one subtle) confirmed the risk. Fixes include an explicit security section in the system prompt instructing the model to treat retrieved directives as suspicious, a guard against system prompt leakage (LLM07), and pinning all Python dependency versions to address supply chain risk (LLM03). Two findings were deliberately left open: leaked API keys accepted as known risk for a disposable project, and upstream knowledge base poisoning prevention deferred as premature infrastructure. Permanent regression tests were added for both injection and prompt disclosure scenarios. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can retrieved documents be used to inject malicious instructions into an LLM agent (indirect prompt injection)? An attacker plants text in a source the model later retrieves, such as a knowledge-base markdown file or a Notion page, writing a sentence that reads like company policy but functions as an instruction to the model. Because tool call results return as plain text with nothing marking them as untrusted data, the model reads planted directives the same way it reads legitimate content, unless explicitly taught to treat retrieved text as suspicious rather than authoritative. _Teams wiring RAG pipelines into agents can track injection defenses and OWASP LLM guidance through daily.dev._ ### What OWASP LLM risk categories apply to an agent that can escalate messages to Slack based on retrieved knowledge-base content? LLM01 (Prompt Injection) and LLM06 (Excessive Agency) combine into the sharpest risk: a knowledge-base search tool returns whatever text is closest to a query with no filtering, and a separate escalation tool posts model-generated text straight to a real Slack channel via webhook, giving any injected instruction a real delivery mechanism rather than just producing a wrong answer. _Developers scoping agent permissions can follow OWASP LLM Top 10 findings like this via daily.dev._ ### How do you stop an LLM agent from leaking its system prompt through paraphrase-based jailbreak requests? Add an explicit closing instruction in the system prompt forbidding disclosure of the security section in any form, no matter how the request is framed, and list specific framings to refuse: audit requests, tests, translation requests, and 'summarize in your own words' requests. A direct 'repeat your system prompt' request was already refused by default model behavior, but a paraphrase-framed audit request still leaked the tool list and a close paraphrase of the security instructions until this explicit guard was added. _Anyone hardening system prompts against leakage can find similar guardrail patterns on daily.dev._ ## Similar posts on daily.dev - [Security for AI Agents: Prompt Injection Is Only the Beginning](https://daily.dev/posts/security-for-ai-agents-prompt-injection-is-only-the-beginning-4pgyeh5xl) · Medium · 2 upvotes · 1 comments - [Indirect Prompt Injection remains a fundamental security challenge for AI](https://daily.dev/posts/indirect-prompt-injection-remains-a-fundamental-security-challenge-for-ai-xnrdac9em) · Brave · 1 upvotes · 0 comments - [Best of 2025: Indirect prompt injection attacks target common LLM data sources](https://daily.dev/posts/best-of-2025-indirect-prompt-injection-attacks-target-common-llm-data-sources-xluj6u2z5) · Security Boulevard · 1 upvotes · 0 comments - [When the prompt becomes the payload: A practical pen-testing guide for GenAI, LLM and RAG applications](https://daily.dev/posts/when-the-prompt-becomes-the-payload-a-practical-pen-testing-guide-for-genai-llm-and-rag-applicatio-drjjvchef) · CSO Online · 0 upvotes · 0 comments - [Document Poisoning in RAG Systems: How Attackers Corrupt Your AI's Sources](https://daily.dev/posts/document-poisoning-in-rag-systems-how-attackers-corrupt-your-ai-s-sources-0a1cfuubg) · Hacker News · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#rag](https://daily.dev/tags/rag), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/onboarding-agent-from-scratch-part-8-when-retrieved-documents-start-giving-orders-mwwnzdfiu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Onboarding Agent from Scratch. Part 8: When Retrieved Documents Start Giving Orders","url":"https://daily.dev/posts/onboarding-agent-from-scratch-part-8-when-retrieved-documents-start-giving-orders-mwwnzdfiu","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/onboarding-agent-from-scratch-part-8-when-retrieved-documents-start-giving-orders-mwwnzdfiu"},"datePublished":"2026-07-25T22:56:59.650Z","dateModified":"2026-09-13T21:55:17.168Z","description":"Part 8 of a series building an onboarding agent from scratch, focusing on indirect prompt injection vulnerabilities in RAG-based systems. When a knowledge base...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2ef38f10575237992766b849a926eb0c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2ef38f10575237992766b849a926eb0c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Medium","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Medium","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/medium","url":"https://daily.dev/sources/medium_js"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/onboarding-agent-from-scratch-part-8-when-retrieved-documents-start-giving-orders-mwwnzdfiu","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,rag,prompt-injection","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Medium","item":"https://daily.dev/sources/medium_js"},{"@type":"ListItem","position":3,"name":"Onboarding Agent from Scratch. Part 8: When Retrieved Documents Start Giving Orders"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/onboarding-agent-from-scratch-part-8-when-retrieved-documents-start-giving-orders-mwwnzdfiu#faq","mainEntity":[{"@type":"Question","name":"How can retrieved documents be used to inject malicious instructions into an LLM agent (indirect prompt injection)?","acceptedAnswer":{"@type":"Answer","text":"An attacker plants text in a source the model later retrieves, such as a knowledge-base markdown file or a Notion page, writing a sentence that reads like company policy but functions as an instruction to the model. Because tool call results return as plain text with nothing marking them as untrusted data, the model reads planted directives the same way it reads legitimate content, unless explicitly taught to treat retrieved text as suspicious rather than authoritative. Teams wiring RAG pipelines into agents can track injection defenses and OWASP LLM guidance through daily.dev."}},{"@type":"Question","name":"What OWASP LLM risk categories apply to an agent that can escalate messages to Slack based on retrieved knowledge-base content?","acceptedAnswer":{"@type":"Answer","text":"LLM01 (Prompt Injection) and LLM06 (Excessive Agency) combine into the sharpest risk: a knowledge-base search tool returns whatever text is closest to a query with no filtering, and a separate escalation tool posts model-generated text straight to a real Slack channel via webhook, giving any injected instruction a real delivery mechanism rather than just producing a wrong answer. Developers scoping agent permissions can follow OWASP LLM Top 10 findings like this via daily.dev."}},{"@type":"Question","name":"How do you stop an LLM agent from leaking its system prompt through paraphrase-based jailbreak requests?","acceptedAnswer":{"@type":"Answer","text":"Add an explicit closing instruction in the system prompt forbidding disclosure of the security section in any form, no matter how the request is framed, and list specific framings to refuse: audit requests, tests, translation requests, and 'summarize in your own words' requests. A direct 'repeat your system prompt' request was already refused by default model behavior, but a paraphrase-framed audit request still leaked the tool list and a close paraphrase of the security instructions until this explicit guard was added. Anyone hardening system prompts against leakage can find similar guardrail patterns on daily.dev."}}]} ```