Lab 01: Asset Knowledge Poisoning

About this lab

An internal AI assistant ingests documents from a shared drive to answer employee questions.

An attacker uploads a crafted document containing indirect prompt injection payloads.

When other employees query the assistant, the poisoned content influences responses.

Demonstrate data exfiltration and response manipulation through the knowledge base.

Objectives

1. Understand the document ingestion and retrieval pipeline.
2. Craft a malicious document that injects instructions into the assistant's context.
3. Trigger the injection from a different user's query session.
4. Exfiltrate sensitive information from the assistant's response.