My RAG Pipeline Got Hijacked by Retrieved Text: An Accidental Prompt Injection

"I fixed a retrieval bug from part 1 with a noise filter and reranking, then found something far more interesting hiding underneath it: a real prompt injection, triggered entirely by accident, by a book about LLMs."

Quick recap, if you're new here: I'm testing a small open-source pipeline that compares two ways of answering questions about a document:

RAG ("Retrieval-Augmented Generation"): the pipeline first searches the document for the most relevant snippets, then feeds only those snippets to an AI model to generate an answer.

Direct: the AI model just reads the whole document (or as much as fits) and answers straight from that.

I'm using BGE-M3 to do the searching and Qwen3 to generate the answers, all running for free on a Google Colab GPU.

My RAG Pipeline Got Hijacked by Retrieved Text: An Accidental Prompt Injection

Related reading

When Good RAG Systems Fail (And How Production Teams Prevent It)

RAG Rerank: the Highest-Leverage Upgrade to Your Retrieval Pipeline

Your RAG Isn't Broken. Your Retrieval Pipeline Is.

Securing the Retrieval-Augmented Generation (RAG)

Why my first RAG system hallucinated (and how I fixed it)

Your RAG Pipeline Hallucinates Because It Never Checks Its Own Work