Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-14 · high
The same researchers warn prompt wording matters almost as much as the retrieval backend, undercutting an easy graph-retrieval fix.
Why now: This landed in coverage on August 14 with a concrete number detection engineering teams can test their own RAG setups against.
Researchers rotated every IP, domain and file hash in nine real threat reports to test whether LLM-built detection plans survive, per a study posted to arXiv. For any team using an LLM to turn threat reports into detection rules, the retrieval architecture decides whether those rules survive an attacker changing infrastructure. In an APT28 case study, GraphRAG kept 100% of detections firing after rotation; a vector-similarity RAG plan held onto just 29%.
The setup held everything constant except retrieval: same report, same generation prompt, same LLM. The pattern held across all nine reports tested, sourced from four different threat intel vendors. GraphRAG plans consistently reached higher tiers of the Pyramid of Pain, targeting attacker tools and behaviors instead of atomic indicators that rotate in minutes.
Rotating IOCs after a report leaks is standard tradecraft for a burned actor, not an edge case. One caveat matters. The authors found prompt wording moved detection accuracy almost as much as the retrieval backend did.
Each link below shares sources, entities, or timing with this story.
Same source domain / Semantically similar
Reported by the same outlet (arxiv.org); covers closely related ground (similarity 0.76).
Reported by the same outlet (arxiv.org); covers closely related ground (similarity 0.75).
Reported by the same outlet (arxiv.org); covers closely related ground (similarity 0.75).
Same source
Cite the same source (arXiv 2608.13050).
Same source domain / Semantically similar
Reported by the same outlet (arxiv.org); covers closely related ground (similarity 0.74).
Reported by the same outlet (arxiv.org); covers closely related ground (similarity 0.75).
Reported by the same outlet (arxiv.org); covers closely related ground (similarity 0.74).
Reported by the same outlet (arxiv.org); covers closely related ground (similarity 0.74).