Vector DB Poisoning

Attacker inserts or replaces embeddings so retrieval preferentially surfaces adversarial or false content.

Impact

Downstream answers and agent decisions are steered by poisoned neighbors in embedding space.

Why this severity

Impact High × Likelihood Medium = High

Impact high: answers are steered at scale. Likelihood medium: demonstrated in research and against M365 Copilot via email ingestion; requires write access to an indexed source.

Impact High: Code execution, credential compromise, exposure of regulated or confidential data, irreversible actions, or system-wide failure.
Likelihood Medium: Publicly demonstrated against real products or in peer-reviewed research, or seen in the wild only with a prior foothold such as stolen credentials.

Method: OWASP Risk Rating Methodology

Evidence

Research: PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models (arXiv 2402.07867, 2024)
Demonstration: Financial Transaction Hijacking with M365 Copilot as an Insider (MITRE ATLAS case study AML.CS0026, 2024)

Exploits

Over-Privileged Retrieval Indexing Vulnerability · High severity

Leads to

Lack of Context Sanitization Vulnerability · High severity

Mitigated by

Pre-Ingestion Scanning Pipeline Guardrail · Fixes critical risks

Remediation

Sign and version every indexed document; reject unsigned upserts.
Anomaly-detect sudden neighborhood density around new vectors.
Segment indexes by trust tier and never mix public crawl with internal ACL data.

How to verify

Attempt unauthorized upserts without signing keys.
Monitor recall drift on a golden query set after each reindex.

Framework mapping

OWASP Top 10 for LLM Applications 2025

LLM08:2025 Vector and Embedding Weaknesses
LLM04:2025 Data and Model Poisoning

MITRE ATLAS

AML.T0070 RAG Poisoning

NIST AI RMF 1.0

MEASURE 2.7 AI system security and resilience are evaluated and documented