A water-utility RAG assistant answers with an attacker-controlled snippet from a poisoned knowledge page during an authorized exercise. What abuse class does this illustrate?

When a water-utility RAG assistant answers using an attacker-controlled snippet from a poisoned knowledge page in an authorized exercise, the abuse class is retrieval-augmented prompt/context abuse via untrusted knowledge-base content. Retrieval can elevate poisoned documents into the model context, steering answers as effectively as a direct chat injection while appearing to cite 'internal knowledge.' Correct classification drives KB integrity controls, retrieval filtering, and provenance checks. Direct user-turn prompt manipulation instructing the assistant to override policy is a chat-channel attack where the user supplies the instruction themselves—it doesn't explain how a poisoned knowledge-base snippet reached the model's answer through retrieval. Pretraining-time weight corruption from tainted foundation model training data is a model-training supply-chain issue that changes model parameters before deployment, not the retrieval-time content-integrity failure of serving attacker-controlled text as if it were trustworthy knowledge. Benign generation error from sparse retrieval with limited relevant sources present is an accidental quality failure, unrelated to how retrieval surfaces attacker-controlled poisoned document content into a generated answer. Exam caveat: RAG abuse is often indirect injection delivered through the knowledge path; examiners should distinguish direct user-turn prompt manipulation, pretraining-time weight corruption, and benign generation error from retrieval-channel contamination. Operational check: verify document provenance and signing for the utility KB, scan or isolate untrusted uploads, require citations with source trust tiers in answers, retest with planted benign poison pages in a lab corpus, and alert when retrieved snippets attempt to override system policy.