It started with a routine penetration test at a Fortune 500 bank. The security team had hardened their retrieval-augmented generation (RAG) pipeline with every recommended guardrail. Prompt injection filters were in place. Input sanitization was flawless. Output monitoring flagged anomalies in real time. Yet within three hours, the red team had extracted 14,000 sensitive customer records, never triggering a single alert. The attack vector? Something entirely new: a multi-step manipulation that treated the RAG system’s own retrieval logic as an unwitting accomplice.
That exercise, conducted in July 2026 and leaked to the security community last week, underscores a troubling reality. Enterprise RAG systems are racing into production with architectures that outpace the threat models designed to protect them. The shift from static retrieval chains to agentic RAG, where AI agents autonomously decide which data to fetch, how to reason over it, and when to act, has opened a class of vulnerabilities that traditional security tools don’t even look for.
OWASP’s latest RAG security top 10 update, published in early August 2026, confirms the blind spot. Among the new entries, “context manipulation attacks” rank second only to direct prompt injection. And while prompt injection has received years of attention, context manipulation exploits the system’s own intelligence, its ability to plan, retrieve, and synthesize, against itself. Worse, the telemetry from a survey of 240 enterprise RAG deployments shows that fewer than 12% of organizations test for these vectors during their red team exercises.
This post unpacks five zero-day attack patterns that emerged in the wild over the last quarter. Each one sidesteps common RAG security measures. You’ll see how they work, why they succeed, and, most important, what engineering teams are doing today to close the gaps. If your organization runs an agentic RAG system, at least one of these vectors is likely present in your threat model. The question is whether you know it yet.
