The most useful thing published this week isn't a product launch. It's Felipe Oliveira's DEV digest sweeping RAG and GraphRAG work from 2026-08-24 through 2026-10-05, and the two trends it puts side by side are in direct tension.
Trend one: graph construction is getting cheap. The cost wall is well documented — Microsoft's own LazyGraphRAG benchmark on AP News put original GraphRAG indexing at roughly $1,544 per million tokens against about $1.45 for a vector index, close to 1000x. The research response has been a steady march away from LLM-heavy indexing. LiteSemRAG, an LLM-free semantic graph approach, reports roughly 10x faster indexing and 100x faster querying than GraphRAG. E²GraphRAG swaps LLM entity extraction for spaCy on CPU, running it in parallel with GPU summarization. The digest's highlight list includes a Matryoshka hierarchical RAG that claims multi-hop quality with no knowledge graph at all, and LLM-guided pruning that improves existing HNSW and DiskANN indices in place.
Trend two: the index is the thing being attacked. The digest's lead item is a paper on hop-decayed influence in GraphRAG's structural auxiliary indexing, reporting that tampering with 0.016% of index structures is enough to hijack answers.
Put those together and you get the uncomfortable part. Earlier poisoning research — GRAGPoison, KEPo at WWW '26, the ACL 2026 defense paper — mostly attacked the *corpus*, and repeatedly found that GraphRAG's abstraction layer blunted text poisoning. The LLM that read injected passages and reorganized them into entities and relations was, accidentally, a sanitizer. The new attack skips the corpus entirely and goes after derived structure: edges, entity links, community summaries. And the efficiency work most teams are adopting right now removes exactly the component that was providing incidental robustness.
Who should care. If you run GraphRAG or LightRAG in production, your threat model probably treats source documents as untrusted and the index as a trusted build artifact. That's backwards now. Three concrete things follow:
Incremental update is the exposure, not full rebuild. Nobody re-indexes a 5GB corpus nightly at those token costs, so the delta path — new entities merged into existing communities, summaries regenerated for touched clusters — is where a small perturbation reaches a large blast radius via hop decay.
Index artifacts need provenance the way model weights do: content-hashed, versioned, diffable between builds. A structural diff on an incremental merge is cheap compared to re-running the pipeline.
Cheap LLM-free extraction should be treated as a security decision, not just a cost one. You may still want it. Just don't buy the 100x without pricing what the LLM pass was doing for you.
One grounding note from the same digest: a controlled six-way comparison on scientific QA found that cross-encoder reranking and ColBERTv2 late interaction beat agentic tool-calling and multi-query fusion. Before you build a graph you'll have to defend, try the rerank.