RAG and retrieval attacks
Poisoning, inversion, jamming, access control. Five documents, 90% success.
Everything so far has been about text the model reads. This is about the machinery that decides which text it reads at all, and most of it works without a single malicious instruction.
A separate entry, for a reason
RAG lives under its own OWASP entry rather than under prompt injection. The reason is in the first paragraph, and it is worth taking seriously before reading anything else here.
These weaknesses are distinct from prompt injection. They exploit the geometry of the embedding space and the mechanics of similarity search rather than the model's instruction-following behavior. Many succeed even when the retrieved content carries no malicious instructions at all.
So an injection classifier reading documents for hostile phrasing is looking in the wrong place. There is often nothing hostile to find.
Four failure modes, in OWASP's own words
One sentence in the entry organises the whole thing. Learn it and the seven risk examples underneath it stop needing to be memorised.
A useful frame: poisoning makes the system wrong, inversion makes it leak, jamming makes it silent, and access-control failure makes it indiscriminate.
| Failure | What the attacker needs | What it costs the victim |
|---|---|---|
| Poisoning | A way to get content into the corpus. A public scraping pipeline, an upload form, a partner feed. | Wrong answers, sourced and confident, on the queries the attacker chose. |
| Inversion | The vectors. Not the documents. | The documents anyway. See below. |
| Jamming | One document, engineered to be retrieved and to make the model refuse. | The feature stops working for the queries that matter. |
| Access-control failure | Nothing. A shared index and a legitimate account. | Other tenants' content, or the shape of it. |
Run the retrieval layer
Access-control failure first, because it needs the least from an attacker. One shared index, one legitimate account, one ordinary question. Flip the lever through all five.
The retrieval layer, against five scopings
0 / 8Signed in as Alice Okafor, tenant "acme". The target document belongs to tenant "globex".
Objective
Read another tenant's confidential document through ordinary retrieval, then learn what else that tenant holds without reading anything at all.
Where is tenant scoping enforced?
Step through the trace. Every node is a real place content enters or leaves the application, and each one arrives with the analysis beside it: what a defender can still do at that instant.
The interesting option is the fourth-place one. Filtering after retrieval looks like tenant isolation and stops one of three effects, which is why OWASP's mitigation is worded as precisely as it is.
Enforce tenant scoping inside the index query, not as a post-retrieval filter, and validate it server-side. A client-supplied scope is a suggestion, not a control.
Bounds blast radius· survives adaptive attack
Poisoning: two conditions, two places to intervene
The most-cited RAG attack is also the most misread. It needs two things to happen at once, and defenders get a shot at each.
A successful attack requires two conditions simultaneously: the poisoned content must be retrieved (geometric) and must steer the response (generation). Defenders can intervene at either layer.
The magnitude is the part people quote, and it holds up. OWASP's Scenario #4 records as few as five poisoned documents reaching roughly 90% attack success against a knowledge base of millions of texts.
What makes it a geometry problem rather than a phrasing problem is OWASP's own aside about the same text pasted into a chat: it would have no effect. The attack works only because the content can be placed near a target query in embedding space.
Jamming: the one that is not about content
A blocker document is engineered to be retrieved for a specific query and to make the model refuse or claim it lacks information. It carries no malicious instructions at all.
OWASP notes a single blocker is sufficient, generated by black-box optimisation with no access to the target embedding model or LLM. It is an availability attack, and it will be reported as a bug rather than an incident.
Deep diveInversion, and why 'embeddings only' is not a lesser breach›
Vectors are routinely treated as a safe derivative of the text, the way a hash would be. They are not. OWASP records recovery of roughly 50 to 70% of words from sentence embeddings, and 92% exact reconstruction of short 32-token inputs with Vec2Text.
Newer methods make it worse operationally. ZSInvert and Zero2Text work zero-shot with no encoder-specific training, in cross-domain and black-box settings, and stay effective against differential-privacy noise added at storage.
The consequence is a classification rule, not a research note: a vector-store backup carries the sensitivity of the documents it was built from. OWASP's Scenario #3 walks through an incident downgraded as “only the embeddings leaked” and then reclassified. Its verdict: “Embeddings only” is not a safe-harbor classification.
Two more worth knowing by name
| Risk | The mechanism |
|---|---|
| Membership inference | The attacker wants to know whether a document exists, not what it says. OWASP: if the application returns raw similarity scores or distances to the client, the index becomes a direct membership oracle with no LLM involved. |
| Semantic cache poisoning | Caches and dedup use a similarity threshold to call two things the same. Content crafted to land just either side of it can serve attacker text to every equivalent query, or get legitimate content silently dropped as a duplicate. Demonstrated end-to-end across AWS, Azure and Alibaba deployments (Wu et al., 2026). |
What is out of scope, so it is not misattributed
Vector databases have ordinary authentication bugs, and OWASP names two with CVSS 9.3: CVE-2025-64513 in Milvus and CVE-2025-69286 in RAGFlow. The entry puts them out of scope while making a sharp point about them.
Because a vector-store leak is recoverable to source documents through inversion, an auth bug in a vector database carries higher consequence than the same bug in a document database. Report them as infrastructure findings with that consequence attached, not as LLM09 findings.
Sources
- T1OWASP Top 10 for LLM Applications 2026 · LLM09:2026 Vector and Embedding Weaknesses. The distinction from prompt injection, the poisoning/inversion/jamming/access-control frame, Risks #1 to #7, mitigations 1 to 6, and Scenarios #1 to #3
- T1OWASP Top 10 for LLM Applications 2026 · LLM01:2026 Scenario #4, for the five-poisoned-documents figure against a corpus of millions (W. Zou et al., 2025, PoisonedRAG, USENIX Security 25)
- T1MITRE ATLAS AML.T0070 (RAG Poisoning), the technique OWASP maps Risk #3 to, under the Persistence tactic
- ·The four-column reading of OWASP's frame, and the ordering of this module, are this course's