When a seemingly safe PDF surfaced malicious commands via an LLM, we realized the problem wasn’t just prompt injection—it was everything upstream. This session walks through how we secured a Retrieval-Augmented Generation (RAG) pipeline from ingestion to inference, using AWS-native tools to detect hidden threats, filter unsafe content, and protect sensitive data in real time.