OWASP Top 10 for LLM Applications 2025 – LLM08: What are Vector and Embedding Weaknesses?

Many organizations deploying AI applications are no longer relying solely on Large Language Models (LLMs). Instead, they use Retrieval-Augmented Generation (RAG), vector databases, and embeddings to enable AI systems to access organizational knowledge, documents, emails, policies, and proprietary data.

This architecture significantly improves the quality of AI responses. However, it also introduces a new category of security risks.

According to the OWASP Top 10 for LLM Applications 2025, Vector and Embedding Weaknesses occur when attackers manipulate, poison, steal, or exploit the vector databases and embeddings that power AI retrieval systems.

Unlike traditional cyberattacks that target servers or applications directly, these attacks target the AI’s knowledge layer itself. If attackers can influence what the AI retrieves, they can influence what the AI believes.

Vectors and embeddings vulnerabilities

Vectors and embeddings vulnerabilities present significant security risks in systems utilizing Retrieval Augmented Generation (RAG) with Large Language Models (LLMs). Weaknesses in how vectors and embeddings are generated, stored, or retrieved can be exploited by malicious actions (intentional or unintentional) to inject harmful content, manipulate model outputs, or access sensitive information.

Retrieval Augmented Generation (RAG) is a model adaptation technique that enhances the performance and contextual relevance of responses from LLM Applications, by combining pretrained language models with external knowledge sources. Retrieval Augmentation uses vector mechanisms and embedding.

Vectors and embeddings risk examples

Unauthorized Access & Data Leakage

Inadequate or misaligned access controls can lead to unauthorized access to embeddings containing sensitive information. If not properly managed, the model could retrieve and disclose personal data, proprietary information, or other sensitive content.

Cross-Context Information Leaks and Federation Knowledge Conflict

In multi-tenant environments where multiple classes of users or applications share the same vector database, there’s a risk of context leakage between users or queries. Data federation knowledge conflict errors can occur when data from multiple sources contradict each other.

Embedding Inversion Attacks

Attackers can exploit vulnerabilities to invert embeddings and recover significant amounts of source information, compromising data confidentiality.

Data Poisoning Attacks

Data poisoning can occur intentionally by malicious actors or unintentionally. Poisoned data can originate from insiders, prompts, data seeding, or unverified data providers, leading to manipulated model outputs.

Behavior Alteration

Retrieval Augmentation can inadvertently alter the foundational model’s behavior. For example, while factual accuracy and relevance may increase, aspects like emotional intelligence or empathy can diminish, potentially reducing the model’s effectiveness in certain applications.

Prevention and Mitigation Strategies

Permission and access control

Implement fine-grained access controls and permission-aware vector and embedding stores. Ensure strict logical and access partitioning of datasets in the vector database to prevent unauthorized access between different classes of users or different groups.

Data validation & source authentication

Implement robust data validation pipelines for knowledge sources. Regularly audit and validate the integrity of the knowledge base for hidden codes and data poisoning. Accept data only from trusted and verified sources.

Data review for combination & classification

When combining data from different sources, thoroughly review the combined dataset. Tag and classify data within the knowledge base to control access levels and prevent data mismatch errors.

Monitoring and Logging

Maintain detailed immutable logs of retrieval activities to detect and respond promptly to suspicious behavior.

Real-World Attack Scenarios

Scenario 1: Data Poisoning in RAG Systems

Research by Kai Greshake and other researchers demonstrated how indirect prompt injection attacks can be embedded within documents, webpages, and external content sources that are later retrieved by AI systems.

Scenario 2: Vector Database Data Exfiltration

Researchers have shown that embeddings can leak information about the original training data and that model inversion techniques can potentially reconstruct sensitive information.

Scenario 3: Unauthorized Access to Enterprise Knowledge Bases

Researchers have repeatedly demonstrated authorization weaknesses in AI-powered enterprise search systems where retrieval mechanisms fail to properly enforce underlying permissions.

Scenario 4: Embedding Manipulation Attacks

Researchers studying retrieval poisoning and adversarial retrieval attacks have demonstrated techniques that influence ranking algorithms used by vector search systems.

The Vector Database is the new Database

Many organizations spend considerable effort securing their cloud infrastructure, applications, and identities while overlooking the security of their AI retrieval layer. At Reputiva, we increasingly see vector databases becoming a critical component of enterprise AI architectures.

Trust your data, Verify your retrieval

Organizations should treat vector databases with the same level of security scrutiny applied to traditional databases.

Key controls include:

Strong access controls and authentication
Data classification and governance
Continuous monitoring of retrieval activity
Secure document ingestion processes
Prompt injection detection mechanisms
Encryption of embeddings and vector stores
Regular security assessments of AI pipelines

As AI adoption grows, attackers will increasingly target retrieval systems because influencing retrieved knowledge can be just as powerful as compromising the model itself.

Is your AI retrieving trusted information?

Many AI security programs focus on prompts and models while overlooking vector databases, embeddings, and retrieval systems.

Reputiva helps organizations assess and secure AI environments through: