# Extracting Data from RAG-Connected Knowledge Bases

> Master the techniques for extracting sensitive data from Retrieval-Augmented Generation (RAG) pipelines, including indirect injection and metadata manipulation.

Canonical: https://codelivly.com/rooms/extracting-data-from-rag-connected-knowledge-bases
Last updated: 2026-10-11

| | |
|---|---|
| Level | Intermediate |
| Category | Cybersecurity |
| Lessons | 3 |
| Estimated time | 30 min |
| XP | 100 |

This module deep-dives into the unique vulnerabilities of Retrieval-Augmented Generation (RAG) architectures. You will learn how attackers exploit the gap between semantic search and access control to extract confidential documents, manipulate metadata, and perform indirect prompt injection via retrieved context, alongside the architectural defenses required to secure enterprise knowledge bases.

## Lessons

1. Why RAG Systems Introduce New Disclosure Risk (30 min)
2. Probing a RAG System for Out-of-Scope Data (30 min)
3. Guided Lab: Extracting Restricted Data from a RAG-Connected Bot (30 min)

## Related

- [Learning path: System Prompt and Data Extraction](https://codelivly.com/learning-paths/system-prompt-and-data-extraction)
- [All rooms](https://codelivly.com/rooms)