Retrieval-augmented generation (RAG) is a way of building AI assistants so they look things up before they answer. When you ask a question, the system first searches a set of documents for passages that seem relevant. It then hands those passages to the AI model and has it answer from them. For example, a food bank could connect an assistant to its volunteer handbook. When a new volunteer asks about shift rules, the assistant finds the right page and answers from it. This lets an assistant use your organization’s own files without retraining the model.
Why it matters
RAG is useful, but the documents it searches become part of what an attacker can target. If someone slips a misleading or tampered file into that collection, the assistant may repeat what it says. This is one form of data poisoning. Sensitive files are a second risk. If donor records or staff notes are in the collection, the assistant may share them with anyone who asks the right question. Before you connect a tool to your files, ask the vendor three things: which documents it will search, who can add files to that collection, and whether it follows the file permissions you already have.
Published Updated