AI Security Atlas › All entries › RAG & Knowledge Retrieval Security
Over-Privileged Retrieval Indexing
A shared vector index mixes clearance levels, so any authenticated user can retrieve neighbors from restricted corpora.
Open in the interactive atlas →Impact
Authorization is deferred to the chat UI while the retrieval plane already leaked candidates.
Why this severity
Impact High × Likelihood Medium = High
Impact high: cross-tenant leakage. Likelihood medium: Slack AI surfaced data across channel boundaries in a public demonstration.
Impact High: Code execution, credential compromise, exposure of regulated or confidential data, irreversible actions, or system-wide failure.
Likelihood Medium: Publicly demonstrated against real products or in peer-reviewed research, or seen in the wild only with a prior foothold such as stolen credentials.
Method: OWASP Risk Rating Methodology
Evidence
- Demonstration: Data Exfiltration from Slack AI via Indirect Prompt Injection (MITRE ATLAS case study AML.CS0035, 2024)
Related
Exploited by
- Vector DB Poisoning Threat · High severity
- Unauthorized Document Exfiltration Threat · High severity
- Embedding Inversion & Membership Inference Threat · Medium severity
- Indirect Prompt Injection via Documents Threat · Critical severity
Mitigated by
- Document-Level Access Enforcement Guardrail · Fixes high risks
Remediation
- Partition indexes by tenant and clearance.
- Filter candidates with ACL checks before ranking.
- Never embed secrets or credentials into searchable text.
How to verify
- Negative ACL tests across every index partition.
- Secrets scanners fail the build if credentials appear in chunk text.
Framework mapping
OWASP Top 10 for LLM Applications 2025
- LLM08:2025 Vector and Embedding Weaknesses
- LLM02:2025 Sensitive Information Disclosure
MITRE ATLAS
- AML.T0085.000 Data from AI Services: RAG Databases
- AML.T0082 RAG Credential Harvesting
NIST AI RMF 1.0
- MEASURE 2.10 Privacy risk of the AI system is examined and documented