OWASP Top 10 for LLMs
LLM08
Vector and Embedding Weaknesses
RAG retrieval layers can be poisoned, manipulated, or leaked through their vector stores.
Retrieval-augmented generation introduces a new attack surface in the embedding and vector-store layer. Weak access control lets attackers write poisoned documents; embedding inversion can leak source content; and cross-tenant data can bleed through a shared index.
How it shows up
- An attacker writes documents crafted to rank highly for common queries.
- Embedding inversion partially reconstructs the underlying source text.
- A multi-tenant vector store leaks one tenant's documents to another.
Mitigations
- Control who can write to the vector store; authenticate and validate ingested content.
- Isolate tenants and enforce access control at retrieval time.
- Treat retrieved content as untrusted data, not instructions.
- Monitor retrieval quality and audit ingested sources.