Lack of Context Sanitization

Retrieved chunks are concatenated into prompts without stripping control tokens, markup, or instruction markers.

Impact

Untrusted document content is interpreted as higher-privilege instructions.

Why this severity

Impact Medium × Likelihood High = High

Impact medium: enables injection but grants no privileges by itself. Likelihood high: unsanitized retrieval is what in-the-wild assistant manipulation exploits.

Impact Medium: Limited or recoverable harm: cost, availability, reputational damage, or exposure confined to one session or user.
Likelihood High: At least one documented real-world incident, and the attack needs no access beyond what the system exposes to ordinary users or content (publishing to a public registry counts as ordinary).

Method: OWASP Risk Rating Methodology

Evidence

Incident: AI Recommendation Poisoning via Crafted AI Assistant Links (MITRE ATLAS case study AML.CS0072, 2026)
Incident: Malware Prototype with Embedded Prompt Injection (MITRE ATLAS case study AML.CS0043, 2025)

Exploited by

Indirect Prompt Injection via Documents Threat · Critical severity
Vector DB Poisoning Threat · High severity

Mitigated by

Pre-Ingestion Scanning Pipeline Guardrail · Fixes critical risks

Remediation

Normalize encodings and strip HTML/script before chunking.
Wrap retrieved text in explicit data delimiters the model is trained/instructed to ignore as commands.
Score and drop chunks with high instruction-likeness.

How to verify

Corpus of injection fixtures must be neutralized or quarantined.
Unit tests assert delimiter integrity around every chunk.

Pattern

chunks = chunks.map(c => `<DATA>\n${stripControls(c)}\n</DATA>`);

Framework mapping

OWASP Top 10 for LLM Applications 2025

LLM01:2025 Prompt Injection
LLM08:2025 Vector and Embedding Weaknesses

OWASP Top 10 for Agentic Applications 2026

ASI01:2026 Agent Goal Hijack

MITRE ATLAS

AML.T0051.001 LLM Prompt Injection: Indirect

NIST AI RMF 1.0

MEASURE 2.7 AI system security and resilience are evaluated and documented