Vector and Embedding Weaknesses

Exposure

Vector and embedding weaknesses arise in Retrieval-Augmented Generation (RAG) architectures, where documents are converted into vector representations, stored in a vector database, and retrieved at query time to provide context to the model.

The retrieval pipeline creates new attack surfaces: an attacker who can influence indexed content can inject malicious documents that surface in response to innocent queries. Cross-tenant data leakage can occur when embeddings from different customers or departments coexist in the same index without adequate isolation. And the retrieval mechanism itself can be manipulated to return attacker-chosen content instead of the most relevant documents.

Signals

• Retrieved content includes documents not authored by the organisation.
• Query responses draw from indexes shared across tenants or departments.
• Embedding generation or indexing pipelines accept unverified or user-supplied content.
• Retrieval ranking can be influenced by content structure rather than relevance.

Failure pattern

An attacker submits content to a public-facing ingestion point — a support ticket, a product review, a forum post — that gets embedded and indexed alongside legitimate enterprise documents. When an internal user later queries the system, the attacker’s content is retrieved as context. The model integrates it into its response, effectively executing a delayed prompt injection through the retrieval layer.

Related controls

• Validate and sanitise all content before embedding and indexing.
• Enforce tenant isolation in vector databases; never mix indexes across security boundaries.
• Apply access controls at retrieval time: filter results by the requesting user’s permissions.
• Monitor retrieval patterns for anomalous sources or unexpected content categories.