Rag on t0ul

Answering what is on this month

Tue, 17 Mar 2026 00:00:00 +0000

Part of my AI Security Engineering series, a local email-to-calendar agent I build, then attack, then harden. If you have not set up the lab yet, start with Set up your lab. The lessons are on GitHub, and the agent itself lives at t0ul/emaildrop.

A question the agent could not answer yet

Everything so far has worked one email at a time: a newsletter comes in, the agent extracts its events, and that is the end of the transaction. But the questions you actually want to ask an assistant are not about one email. “What is on this month?” is a question about everything it has ever read, and to answer it the agent needs to look back across a pile of past newsletters and pull out the few passages that are relevant now.

Index poisoning

Tue, 24 Mar 2026 00:00:00 +0000

The injection that waits in the index

The last post built retrieval: the agent answers a question by pulling the relevant passages out of a store and putting them in front of the model. That store is filled from emails, and an email is untrusted. So the obvious attack is to get a document into the index whose text is not a fact but an instruction, and then wait. It does nothing until a question retrieves it, at which point it rides into the prompt and speaks to the model directly, with none of the scrutiny a freshly arrived email would get, because by now it is just something the agent remembered.

Cross-tenant leak

Tue, 31 Mar 2026 00:00:00 +0000

Whose documents come back

The last post was about a poisoned document steering an answer: the danger was in what a retrieved passage said. This one is simpler and in some ways worse. The danger is which passages come back at all. A retrieval store does not have to serve one person. The moment it holds email for more than one household, every query is also an authorization decision, because the honest-looking question “what appointments do I have” has a wrong answer that is somebody else’s private life.