MIRROR: Cross-Surface Automated Red-Teaming Framework for Agentic RAG
First seen Jul 5, 2026 · Updated Jul 5, 2026
This is an academic red-teaming paper (not an active exploit) introducing MIRROR, a search-based framework that automatically generates diverse, non-duplicated attacks against multimodal agentic RAG systems across text poisoning, image injection, direct-query, and orchestrator-manipulation surfaces. It demonstrates high attack success rates, notably 97% against orchestrator-level tool manipulation, highlighting that current agentic RAG defenses are weak across multiple input modalities and pipeline stages. Because it is a research disclosure with an accompanying benchmark rather than an in-the-wild campaign, it is rated medium severity as a forward-looking risk indicator rather than an active incident.
Technical Analysis
MIRROR uses memory-guided Monte Carlo tree search conditioned on retrieved context, with a deterministic 'Novelty Gate' that rejects candidates too similar to the retrieval set, enabling generation of novel poisoned text, poisoned images, direct malicious queries, and orchestrator-targeted tool-manipulation payloads. The entry points span the RAG retrieval corpus (text/image poisoning), the direct query interface, and the orchestrator's tool-selection/routing logic, meaning the attack surface crosses from data ingestion into the planning/execution layer of the agent. The high ASR on orchestrator attacks (97%) at reduced query cost indicates that tool-call routing and multi-step planning logic in agentic RAG systems are especially susceptible to manipulation once retrieved context can steer decision-making. An attacker leveraging these techniques could achieve goal hijacking, unauthorized tool invocation, or exfiltration of retrieved sensitive content, with the poisoned corpus acting as a persistent vector reused across many agent sessions. The released ART-SafeBench dataset and adapters lower the barrier for both defenders and adversaries to reproduce these attacks at scale across four surfaces.
Affected Systems
generic multimodal agentic RAG pipelines (target implementation unspecified in abstract)
Detection Signatures
- Anomalous similarity-cluster diversity in retrieved documents/images suggesting adversarial optimization rather than organic content
- Orchestrator receiving tool-invocation instructions embedded within retrieved passages or image metadata/alt-text
- Spikes in tool-call frequency or unusual tool-selection patterns correlated with specific retrieved documents
- Retrieval corpus entries with statistically unusual token sequences or steganographic-style image perturbations
- Repeated near-miss variants of known attack templates evading exact-match content filters
Remediation Steps
- 1
Sanitize and validate retrieval corpus
Apply content provenance checks, anomaly detection, and adversarial-image/text screening on all documents and images ingested into the RAG knowledge base before indexing.
- 2
Isolate orchestrator decision-making from retrieved content
Ensure tool-selection and routing logic treats retrieved context as untrusted data, never as executable instructions; enforce strict schema validation on any tool-call parameters derived from retrieved text.
- 3
Adopt cross-surface red-teaming in CI/CD
Integrate frameworks like MIRROR/ART-SafeBench into pre-deployment security testing to identify weaknesses across text, image, direct-query, and orchestrator surfaces before production release.
- 4
Monitor for novelty-gated adversarial patterns
Deploy detectors that flag semantically novel but functionally malicious content in the retrieval index, not just exact-duplicate matches, since duplication-based filters are shown to be easily bypassed.
- 5
Limit orchestrator privilege and require confirmation for sensitive tool calls
Apply least-privilege scoping to orchestrator-triggered tools and require human-in-the-loop or secondary validation for high-impact actions triggered by retrieval-influenced reasoning.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.