document-poisoning 1 RAG Security: The Hidden Attack Surface of Retrieval-Augmented Generation Jun 1, 2026