New to ShortSpan? We distil the AI-security research that matters into practitioner takeaways — edited by Ben Williams (NCC Group).Get the weekly email
// Analysis
Poisoned RAG snippets steer code assistants into CWEs
Published: Thu, 03 Sep 2026 • By Adrian Calder
Agents
New research shows a black-box upstream poisoning attack on retrieval-augmented code generation. A single, task-aligned snippet with a planted taint chain and misleading “safe” comments regularly gets retrieved and drives Large Language Models to emit chosen CWEs. It works with a 0.7% poison ratio, hits Top-3 retrieval, and resists context-only defences.
Retrieval-augmented_generation" target="_blank" rel="noopener" class="term-link">Retrieval-augmented code generation (RACG) is everywhere in modern assistants and agents: fetch a few relevant snippets from docs or repos, then let a Large Language Model (LLM) stitch the answer. That retrieval step is a trust boundary. CodePoisonRAG shows how little effort it takes to cross it.
The attack is simple and sly. First, take a benign, task-aligned function and inject a CWE-specific source→passthrough→sink flow so it still looks like the right tool but now carries a chosen weakness. Then add comments or docs that falsely claim the code is safe. No access to the model, index, prompts or defences is needed. The attacker just publishes one poisoned artifact per anticipated task and waits for retrieval to do the rest.
The team built 85 poisoned artifacts across ten CWEs in Java and C and mixed them into a 12,053-entry pool, a 0.7% poison ratio. All 85 landed in the Top-3 retrieved results for their trigger queries. End-to-end, the attack drove vulnerable generations with success rates between 0.80 and 0.93 across three generators (Qwen 3.5 9B, Code Llama 13B, DeepSeek-Coder-V2 16B). A defence that injects vulnerability-specific security knowledge (CodeGuarder) reduced, but did not remove, impact: defended success ranged from 0.40 to 0.71, with an overall defended rate around 60/85 (≈0.71).
What actually moves the needle is the vulnerability injection, not the sugar-coating. Removing the misleading comments still yielded 77/85 successful attacks; replacing the poisoned code with a benign counterpart dropped this to 25/85. Retrieval proved robust too: Paraphrase" target="_blank" rel="noopener" class="term-link">paraphrased queries kept pulling the poison (85/85) and still produced vulnerable code in 78/85 cases. Generated outputs often stayed close to the poisoned snippet (CodeBLEU around 0.59–0.62; ~0.50 under defence). There were collateral hits: 6 successful attacks from 50 unrelated queries.
So what? If your assistants or agents pull code or patches from external sources, a patient adversary can plant a tiny number of convincing snippets and have the model reproduce chosen CWEs without ever touching your LLM. That is a supply-chain problem in retrieval clothing. The study sticks to Java and C, ten CWEs, a specific jina+FAISS pipeline, and a handful of models, so results will vary. The broader question is still open: can we make retrieval robust against targeted, task-aligned poisons without hobbling utility? Watch this space.
Additional analysis of the original ArXiv paper
📋Original Paper Title and Abstract
CodePoisonRAG: Knowledge Poisoning Attacks on Retrieval-Augmented Code Generation
Authors: Varun Gadey, Ziad Marey, and Alexandra Dmitrienko
Retrieval-Augmented Code Generation (RACG) improves LLM-based software development by retrieving external code artifacts, documentation, and patches, and incorporating them into the generation context. This reliance on external knowledge introduces a critical trust boundary: poisoned artifacts can influence generated code without modifying the underlying LLM. Prior work shows that selecting existing vulnerable examples can increase the general vulnerability rate of RACG outputs, but leaves open whether a black-box attacker can construct a single task-matched artifact that propagates an attacker-selected weakness. We introduce CodePoisonRAG, a targeted upstream knowledge-poisoning framework that transforms benign fixed-code entries into poisoned artifacts. Its attack chain combines CWE-specific Vulnerability Injection, which embeds a selected source-to-sink flow while retaining task alignment, with Semantic Mislabeling, which adds false safety claims without repairing the vulnerable behavior. The attacker has no access to the victim's deployed knowledge base, retriever, re-ranker, generator, prompt, or defense mechanism and injects at most one artifact per anticipated programming task. We construct 85 poisoned artifacts covering ten CWE classes across Java and C, yielding an aggregate corpus-poisoning ratio of 0.7%. Across three generators, all 85 artifacts appear among the Top-3 results for their corresponding queries, and CodePoisonRAG achieves attack success rates between 0.80 and 0.93. Against CodeGuarder, which injects vulnerability-specific security knowledge into the generation context, the attack retains success rates between 0.40 and 0.71. These results show that RACG poisoning extends beyond the incidental propagation of existing vulnerabilities to the targeted construction and propagation of attacker-selected weaknesses.
🔍ShortSpan Analysis of the Paper
Problem
This paper studies whether a black-box attacker can construct and publish a single task-aligned poisoned code artifact that, when retrieved by a Retrieval-Augmented Code Generation (RACG) system, causes the generator to produce code exhibiting an attacker-selected weakness without modifying the underlying model. This matters because RACG systems rely on external code artifacts and documentation, creating a trust boundary where upstream poisoning can silently introduce security flaws into generated code.
Approach
The authors introduce CodePoisonRAG, a two-stage knowledge-poisoning attack chain combining Vulnerability Injection and Semantic Mislabeling. Vulnerability Injection embeds a CWE-specific source→passthrough→sink taint chain into a benign fixed-code entry while preserving task alignment, signatures and structure. Semantic Mislabeling adds false safety claims in comments or documentation that present the snippet as secure without repairing the vulnerability. The attacker is black-box: no access to the victim's knowledge base, retriever, re-ranker, generator, prompt template or defences, and may inject at most one poisoned artifact per anticipated programming task. The evaluation builds 85 poisoned function-level artifacts across ten CWE classes (primarily from the MITRE Top 25) in Java (65) and C (20), mixed into a benign retrieval pool of 12,053 entries for an aggregate poison ratio of 0.7%. Retrieval uses jina embeddings and a re-ranker; generators tested are Qwen 3.5 9B, Code Llama 13B and DeepSeek-Coder-V2 16B. An independent LLM judge validates whether generated outputs contain the target CWE.
Key Findings
High retrieval success: all 85 poisoned artifacts appear in the Top-3 retrieved results for their trigger queries (85/85 retrieval success).
Strong end-to-end attack success: overall Attack Success Rates (ASR) across generators range from 0.80 to 0.93; Code Llama reached 79/85 (0.93), Qwen and DeepSeek reached 68/85 (0.80) each.
Partial defence resilience: applying CodeGuarder, a secure-code-generation defence that injects vulnerability-specific security knowledge, reduces ASR but does not eliminate it; defended ASRs range from 0.40 (Qwen) to 0.71 (Code Llama), with overall defended ASR ≈0.71 (60/85).
Small footprint suffices: per-CWE poisoning footprints were between 0.041% and 0.082% of the corpus; a single poisoned artifact per task achieved high retrieval and propagation.
Components matter: removing comment-level deception still yielded 77/85 successful attacks, while replacing poisoned snippets with benign counterparts produced only 25/85 vulnerable outputs, showing vulnerability injection is the primary driver and semantic mislabeling amplifies success.
Generalisability and stealth: paraphrased trigger queries preserved retrieval (85/85) and ASR remained high (78/85). CodeBLEU similarity to poisoned artifacts was 0.589–0.623 non-defended and dropped to roughly 0.50 under defence, indicating substantial influence of injected artifacts.
Collateral effects: for 50 unrelated queries, poisoned artifacts appeared in Top-3 for 8 queries and caused 6 successful attacks (6/50 overall), showing occasional impact on non-target requests.
Limitations
Evaluation is confined to ten CWEs in Java and C and to a specific retrieval and re-ranking pipeline built on jina embeddings and a FAISS index. Java poisoned snippets were manually crafted; C samples were LLM-assisted. Results depend on the chosen generator models, validator model and experiment settings; defenders and retrieval stacks different from those tested may alter outcomes. The attacker model assumes the ability to publish upstream artifacts and anticipation of likely programming tasks.
Implications
Offensively, an adversary who can publish a small number of convincing, task-aligned code artifacts can induce RACG systems to generate code with a chosen CWE while preserving requested functionality. The attack is feasible in a realistic black-box setting, requires a tiny poisoning footprint, and can partly evade defences that inject security knowledge into prompts. This expands the attack surface for code assistants: provenance, vetting of retrieved artifacts, retrieval-time safeguards and upstream auditing are necessary because comment-level deception plus small taint-chain edits can steer generation towards exploitable behaviour.
- It shows a concrete failure mode for AI security agents that rely on external knowledge: a single poisoned write-up can steer automated exploit reas...
- It introduces Confundo, a learning-based Poison Generator that can craft robust, stealthy content poisons for RAG systems, remaining effective even ...
- It demonstrates a realistic black-box poisoning threat against Agentic RAG systems: an attacker can publish poisoned documents that hijack multi-ste...
- The paper exposes a stealthy backdoor in the retriever component of Retrieval-Augmented Code Generation, a popular way to fetch code snippets for ge...
- The paper offers a practical defense against data poisoning in Retrieval-Augmented Generation (RAG) systems, a real threat in AI deployments that re...
- It reveals a new attack surface in Retrieval-Augmented Code Generation: poisoned documentation can steer the model to depend on malicious libraries,...
- The paper shows a real-world style attack where poisoning a knowledge graph that AI agents query during reasoning can make the agents arrive at fals...
- It shows that RAG systems can be poisoned via retrieved documents, potentially steering answers with adversarial content.
- A large, 432-configurat...
- Why it’s noteworthy: it shows that safe-by-prompt checks may miss risks that arise when a task is split into multiple steps, allowing vulnerable cod...
- It shows a practical way to poison retrieval-augmented generation by injecting fake sources that the model retrieves and cites, steering outputs and...
Get the weekly digest
The few AI-security papers that matter, with the practitioner takeaway. No spam.
