RAG systems can make LLMs less safe, not more