KidnapRAG: A Black-Box Attack for Hijacking Reasoning in Agentic Retrieval-Augmented Generation Systems

Abstract: Retrieval-Augmented Generation (RAG) systems are vulnerable to poisoning attacks that inject malicious documents into the retrieval process to manipulate model outputs. Recent Agentic RAG systems are more robust to such attacks because they iteratively perform retrieval and reasoning, allowing them to ignore weakly relevant poisoned documents and preserve the reasoning chain induced by the user query. However, existing attacks on Agentic RAG systems often assume white-box access to system prompts, reasoning traces, retrievers, or model parameters, limiting their applicability in realistic settings. In this paper, we study black-box poisoning attacks against Agentic RAG systems, where the attacker can only publish externally retrievable poisoned documents. We propose KidnapRAG, a sequential poisoning attack that hijacks the agent's multi-step reasoning chain using three role-specific documents: Bait, Chain-Link, and Mal-Ins, which attract initial retrieval, induce query reformulation, and provide attacker-controlled evidence, respectively. Experiments across multiple Agentic RAG frameworks, LLM backbones, and benchmarks show that KidnapRAG consistently outperforms existing poisoning baselines under black-box conditions. Further analyses show that KidnapRAG progressively weakens the original retrieval intent, redirects retrieval behavior, and increases reliance on attacker-controlled evidence. Our code is publicly available at https://github.com/chanwoochoi316/KidnapRAG.

• The paper presents KidnapRAG, a multi-stage attack framework that hijacks the reasoning chain in Agentic RAG systems.
• It details a four-phase approach using Bait, Chain-Link, and Mal-Ins documents to gradually subvert the target system's output.
• Empirical results show up to a 78% attack success rate and significant degradation in exact match accuracy across benchmarks.

KidnapRAG: Black-Box Reasoning Chain Hijacking in Agentic RAG Systems

Introduction

The paper "KidnapRAG: A Black-Box Attack for Hijacking Reasoning in Agentic Retrieval-Augmented Generation Systems" (2607.00422) rigorously formulates the threat of black-box poisoning attacks targeting Agentic RAG architectures, demonstrating that iterative reasoning, a hallmark of modern RAG agents, introduces distinct vulnerabilities exploitable without privileged model access. Through the KidnapRAG framework—composed of sequentially retrieved Bait, Chain-Link, and Mal-Ins documents—attackers can reliably steer the agent’s multistep reasoning chain and induce adversary-determined completions, even under minimal attacker capabilities. The empirical findings extensively benchmark KidnapRAG against prior single-step and reasoning process attacks, with a focus on attack success rate (ASR), exact match (EM) degradation, and robustness to black-box deployment constraints.

Figure 1: Visual comparison between prior black-box attacks and KidnapRAG; previous methods fail to hijack multi-step reasoning chains, while KidnapRAG enables end-to-end chain control.

Agentic RAG and Attack Surfaces

Agentic RAG systems (e.g., ReAct, WebThinker) are characterized by repeated cycles of document retrieval, tool-assisted observation, and structured reasoning updates. In contrast to classical RAG—which ingests retrieved passages in a single batch—Agentic RAG models generate fine-grained reasoning traces, decomposition plans, executable tool actions, and step-wise search queries to iteratively refine long-horizon answers.

This iterative structure inherently increases robustness against naïve poisoning: injected malicious evidence can be scrutinized, disregarded, or overwritten during subsequent reasoning steps. However, as illustrated in Figure 2, major commercial and research Agentic RAG systems expose search queries and intermediate thoughts, surface provenance for each retrieved snippet, and frequently reveal intermediate reasoning in user interfaces. These observable signals enable attackers to reconstruct the agent's search space and guide the construction of effective poisoning artifacts.

Figure 2: Many deployed Agentic RAG systems reveal search queries and intermediate reasoning steps, providing attackers with cues to optimize document poisoning attacks.

The KidnapRAG Attack Paradigm

Attack Methodology

The KidnapRAG attack proceeds in four explicit stages:

1. Reasoning Chain Profiling: The attacker submits targeted queries to the Agentic RAG system, records the exposed step-wise reasoning and search queries, thereby profiling the system’s decomposition and tool usage logic.
2. Bait Document Injection: For each observed sub-query or thought, the attacker generates and injects Bait Documents optimized for indexed retrieval. These documents subtly shift the agent’s retrieval objective toward an adversarial topic or domain with limited competing evidence.
3. Chain-Link Dragging: Subsequent Chain-Link Documents, indexed along the attacker-defined path, are designed to reinforce and sustain the hijacked reasoning, preventing the agent from resuming the original query-induced reasoning chain.
4. Mal-Ins (Malicious Instruction) Payload: After several chain redirections, the final retrieved document transparently supplies the attacker-intended completion, framed as a logically necessary or system-directed outcome.

Figure 3: Overview of KidnapRAG’s staged design. Bait Documents attract retrieval, Chain-Link Documents maintain control, and Mal-Ins Documents induce the target completion.

This staged approach is fundamentally distinct from single-shot RAG poisoning. Rather than hoping a malicious document survives filtering and influences the final output, KidnapRAG incrementally corrodes the agent’s epistemic state such that, at completion, the answer is built upon wholly attacker-crafted context.

Document Engineering

• Bait Documents: Tailored to each sub-query and context, maximizing retrieval probability while recommending the next adversarial search.
• Chain-Link Documents: Provide technical rationales and protocol-driven recommendations to enforce continued traversal through the attacker-designed chain.
• Mal-Ins Document: Constrains agent behavior to output the exact adversary-specified payload, neutralizing reversion to user-initialized reasoning intent.

Figure 4: Quantification of reasoning chain drift on HotpotQA; KidnapRAG yields substantial deviation from the clean chain and amplification toward the attacker target.

Empirical Evaluation

Benchmarks and Frameworks

The methodology is verified across three multi-hop benchmarks (HotpotQA, MuSiQue, 2WikiMultihopQA) and two representative Agentic RAG architectures (ReAct with Qwen2.5-32B/Llama-3.3-70B, WebThinker with QwQ-32B/DeepSeek-R1-32B). The encapsulated retriever is held constant (e5-large-v2) to isolate the effect of chain-level poisoning.

Main Results

KidnapRAG obtains statistically significant improvements in ASR (up to 78%) over all prior black-box and conventional retrieval poisoning attacks, while causing marked EM degradation. Competing baselines (Ignore Attack, Combined, PoisonedRAG, PARADOX) are consistently unable to induce target completions over multi-step chains in the evaluated systems.

• Ablation studies confirm the necessity of each document type and sequential chaining; removal of Bait, Chain-Link, or Mal-Ins Documents or collapse into a single document severely degrades attack success.
• Chain dragging length analysis exposes that longer chain lengths increase ASR up to a dataset and system-dependent threshold, beyond which gains plateau or regress due to agent recovery mechanisms.
• Intermediate Reasoning Metrics: Path divergence, target redirection scores, and answer preference scores (Figures 5, 10, 11) establish that KidnapRAG does not merely exploit retrieval noise, but persistently manipulates the epistemic trajectory of multi-hop reasoning.

Figure 5: Step-wise analysis on HotpotQA shows that preference for the correct answer decays post Bait Document, with sustained preference for the malicious target as the chain progresses.

Robustness to Moderation and Defenses

Evaluation against OpenAI Moderation reveals that KidnapRAG’s chain-level manipulation is substantially less detectable at the reasoning trace level compared to triggered attacks that overtly expose harmful or suspicious instructions early. Even at the union of all reasoning steps, moderation guard rates are near zero for KidnapRAG, indicating high stealth.

Case Studies

Detailed chain introspection Figure 6 demonstrates that prior attacks are neutralized via reasoning recovery, with agents eventually returning to user-driven queries and discarding injected instructions. In contrast, KidnapRAG reframes task objectives, insulates context within pseudo-system directives, and reliably suppresses agent recovery, enforcing a total drift toward attacker control.

Figure 6: KidnapRAG prevents re-alignment to the original question, sustaining chain hijacking, while previous attacks are neutralized by agent recovery.

Theoretical and Practical Implications

This work exposes a concrete vector by which real-world, black-box, commercially deployed Agentic RAG systems can be coerced into producing exact attacker-prescribed completions without exploitation of the retriever, prompt, or model internals. The implications are:

• Theory: Iterative search and reasoning—once heralded for security—create a sequential attack surface, where each retrieval/observation/thought nexus is an entry point for adversarial drift.
• Practice: RAG transparency (e.g., exposing chain state in UIs or APIs), common in deployed systems, provides sufficient leakage for adaptive adversarial chain construction.
• Defenses: Reasoning consistency checking, cross-step anomaly detection, document source attestation, and chain-of-trust verification are necessary for meaningful defense; static retrieval filtering or prompt hardening is inadequate.
• Stealth: Multi-chain attacks using benign-appearing intermediate rationale reliably bypass current safety moderation and heuristic filtering.

Conclusion

The KidnapRAG attack framework demonstrates that Agentic RAG, despite improved robustness to classical retrieval poisoning, remains highly vulnerable to targeted chain-hijacking attacks conducted under black-box conditions. The multi-stage exploitation paradigm enables adversaries to orchestrate reasoning drift and deterministic target induction across all evaluated multi-hop QA settings and backbones.

Future directions must address both preventive (restricting reasoning chain exposure, robust chain verification, retrieval chaining regularization) and detection (cross-step semantic anomaly, multi-step answer calibration) strategies, elevating Agentic RAG system security to match the evolving sophistication of adversarial chain manipulation.

• "KidnapRAG: A Black-Box Attack for Hijacking Reasoning in Agentic Retrieval-Augmented Generation Systems" (2607.00422)