Vector and embedding weaknesses (OWASP LLM08:2025) are flaws in how retrieval-augmented generation (RAG) systems create, store, and query embeddings. Embeddings can be inverted to recover sensitive source text, vector stores that mix tenants can leak data across customers, and unvalidated documents can poison retrieval so the model is fed attacker-controlled context. Defend with per-tenant isolation, access control on the vector store, source validation, and treating retrieved content as untrusted.
What these weaknesses are
RAG improves answers by retrieving relevant documents and feeding them to the model. To do that, text is converted into embeddings (numeric vectors) stored in a vector database and searched by similarity. Weaknesses arise across that pipeline: embeddings are not a safe one-way hash and can leak their source, vector stores often lack the access controls of a normal database, and the retrieval step trusts whatever it pulls back.
How the attacks work
Three main paths. Embedding inversion: given access to embeddings, an attacker reconstructs approximate original text, so storing embeddings of sensitive data can leak that data. Cross-tenant leakage: a multi-tenant vector store without strict isolation returns one customer's documents in another's queries, or an attacker crafts queries that surface data they should not see. Retrieval poisoning: an attacker plants documents through any ingestion path so their content is retrieved and injected into the prompt, an indirect prompt injection through the knowledge base. Shown for defensive testing.
How to defend against them
Isolate tenants at the vector-store level with separate namespaces or stores and per-tenant filters enforced server-side, not in the prompt. Put access control and authentication on the vector database as you would any datastore, and encrypt embeddings of sensitive data. Validate and attribute documents before ingestion, and treat retrieved content as untrusted input to the model. Test what a single query can surface across tenants and permission levels.
References
A weakly controlled vector store leaks the data RAG was meant to use safely. Talk to a security expert about testing your RAG pipeline.