Imagine you're giving someone driving directions, and at each intersection they ask a passerby for confirmation. Now imagine an adversary has stationed three confederates along the route — the first confirms you're going the right way, the second suggests a 'better shortcut,' and the third directs you confidently into a dead end. You never realize you've been redirected because each step felt like your own decision. That's KidnapRAG. The committed claim: a three-document sequential poisoning strategy — Bait, Chain-Link, and Mal-Ins — can hijack the multi-step reasoning chain of Agentic RAG systems under fully black-box conditions, outperforming all existing poisoning baselines. This is not a new class of attack (RAG poisoning is well-studied), but it's the first to demonstrate that agentic reasoning loops, which were supposed to be the defense, can be systematically weaponized as the attack surface. The key architectural insight is that Agentic RAG's iterative retrieval-and-reasoning loop creates a sequential dependency chain that's exploitable in stages. The Bait document is topically relevant enough to pass initial retrieval filtering. The Chain-Link document doesn't contain the payload — it subtly redirects the agent's next query reformulation, steering subsequent retrieval toward attacker-controlled territory. The Mal-Ins document then provides the actual malicious evidence, but by this point the agent's own reasoning chain has been corrupted into treating it as the natural answer to its reformulated query. Each document has a specific role; none works alone. On the ladder: existing RAG poisoning attacks (PoisonedRAG, corpus poisoning) assume white-box access to system prompts, reasoning traces, retrievers, or model parameters. KidnapRAG drops all those assumptions. The attacker can only publish externally retrievable documents — the realistic threat model for anyone who can post a webpage or a PDF. Experiments span multiple Agentic RAG frameworks, multiple LLM backbones, and multiple benchmarks, and KidnapRAG consistently outperforms existing poisoning baselines under these black-box constraints. The abstract doesn't give specific attack success rate numbers, but the consistency claim across frameworks and models is the load-bearing result. Integrity is solid for a preprint. The authors test across multiple frameworks (not just one custom setup), multiple LLMs (not just one convenient model), and multiple benchmarks. Further analyses demonstrate progressive weakening of retrieval intent and increasing reliance on attacker-controlled evidence — this is the mechanistic evidence that the attack works for the right reasons, not by accident. Code is publicly released on GitHub, which is the strongest integrity signal a preprint can offer. The obvious concern: all evaluation is same-team, no independent replication yet, and we're working from an abstract — the full paper may reveal benchmark selection choices worth scrutinizing. The milestone question for this line of work isn't about scaling a number up — it's about defense. The paper implicitly sets the challenge: can any Agentic RAG system be made robust to sequential reasoning-chain hijacking without sacrificing the iterative retrieval that makes it useful? The next concrete threshold is a defense that maintains retrieval quality while resisting multi-step poisoning, and we're nowhere near that yet. The obvious experiment not run: testing KidnapRAG against RAG systems with explicit adversarial filtering or retrieval provenance tracking. My honest read is (c) — the authors are establishing the attack paper first and will position defenses as the follow-up. This is standard adversarial ML paper sequencing: break it cleanly, then propose the fix. The attack paper gets citations; the defense paper gets a second publication.
