Retrieval Augmented Generation (RAG) has become the default architecture for enterprise chatbots that answer questions using internal documents, but this convenience introduces a risk factor that general-purpose LLM safety research does not fully capture. When the retrieved context itself holds confidential information, a successful prompt-based attack is not merely an undesirable answer but a data disclosure event. This paper presents an automated red-teaming framework built for testing RAG-based chatbots with this class of attack. 12 attacks spanning 6 categories were executed as single-turn prompts, multi-turn conversational build-ups, document-embedded indirect injections and AI-paraphrased mutations of the highest severity base attacks. 5 defense configurations escalating from an undefended baseline to a fully stacked pipeline were compared under identical conditions across 3 language models spanning 8 billion to 120 billion parameters range with every attack repeated across 3 independent trials to account for output non-determination. The strongest single configuration (Independent LLM-as-judge review layer) reduced the overall leak rate from 75.0% to 5.6% (92.5% relative reduction) while fully eliminating critical-severity disclosures. Alongside these security results, this work reports a methodological finding of independent interest which is that unstripped model reasoning traces can silently corrupt automated leak-detection pipelines built for reasoning-capable models. A conversation-aware usability test further shows a 0% false-refusal rate even after adversarial exposure within the same session indicating that the evaluated defenses reduce leakage without a corresponding usability cost.

Prompt Injection, Retrieval-Augmented Generation, LLM security, red teaming, Defense-in-depth, RAG chatbot secu-rity, OWASP LLM Top 10.