Risk
Vector and Embedding Weaknesses
Systems that generate, store, or query vector embeddings in RAG architectures introduce their own security risks: injection through indexed data, cross-tenant information leakage, and retrieval manipulation.
- Domain
- Data
- Application
- Mechanism
- Integrity
- Disclosure
- Boundary
- Between indexed data and retrieval
- Trigger
- Injection through indexed data, cross-tenant leakage, or retrieval manipulation
- Consequence
- Retrieval is poisoned or data leaks across tenants
- Required evidence
- Embedding pipeline integrity records
- Tenant isolation tests
- Retrieval audit logs
Exposure
Vector and embedding weaknesses arise in Retrieval-Augmented Generation (RAG) architectures, where documents are converted into vector representations, stored in a vector database, and retrieved at query time to provide context to the model.
The retrieval pipeline creates new attack surfaces: an attacker who can influence indexed content can inject malicious documents that surface in response to innocent queries. Cross-tenant data leakage can occur when embeddings from different customers or departments coexist in the same index without adequate isolation. And the retrieval mechanism itself can be manipulated to return attacker-chosen content instead of the most relevant documents.
Signals
- Retrieved content includes documents not authored by the organisation.
- Query responses draw from indexes shared across tenants or departments.
- Embedding generation or indexing pipelines accept unverified or user-supplied content.
- Retrieval ranking can be influenced by content structure rather than relevance.
Failure pattern
An attacker submits content to a public-facing ingestion point — a support ticket, a product review, a forum post — that gets embedded and indexed alongside legitimate enterprise documents. When an internal user later queries the system, the attacker’s content is retrieved as context. The model integrates it into its response, effectively executing a delayed prompt injection through the retrieval layer.
Related controls
- Validate and sanitise all content before embedding and indexing.
- Enforce tenant isolation in vector databases; never mix indexes across security boundaries.
- Apply access controls at retrieval time: filter results by the requesting user’s permissions.
- Monitor retrieval patterns for anomalous sources or unexpected content categories.
Provenance
- SOURCE
-
- OWASP Top 10 for LLM Applications 2026 ↗ external_authority
- MAPPED
- Not recorded
- ANALYZED
- Not recorded
- UNRESOLVED
- Not recorded
Last reviewed: Sep 20, 2026