# R-09·OWASP LLM09:2026·cases 2·checked Nov. 15, 2026
Vector and embedding weaknesses
The retrieval layer behind a RAG app returns the wrong documents, leaks across permissions, or can be poisoned.
What it is
When similarity search decides what the model sees, the vector index becomes part of your trust boundary. OWASP sums the failure modes up as: poisoning makes the system wrong, inversion makes it leak, jamming makes it silent, and access-control failure makes it indiscriminate.
The most common practical issue is permissions. If the index ignores who may read which document, the chatbot answers from documents the asker could never open directly.
Documented cases
Incidents happened in the wild. Research demos were shown by researchers, often disclosed to the vendor first.
Research demodisclosed June 11, 2025·AML.CS0059 EchoLeak: one email, data out of Microsoft 365 Copilot
Researchers showed that a single crafted email could make Microsoft 365 Copilot send internal data to an attacker with no click from the victim. Copilot pulled the email into its context, and the chain got past an injection classifier and link redaction, then used auto-fetched images and a Teams proxy allowed by the content security policy.
Tracked as CVE-2025-32711, described as AI command injection in M365 Copilot that lets an unauthorized attacker disclose information over a network.
Sources: Reddy and Gujral, arXiv:2509.10540; NIST National Vulnerability Database; MITRE ATLAS AML.CS0059
Research demodisclosed Aug. 20, 2024·AML.CS0035 Slack AI leaked a private-channel API key
PromptArmor posted an instruction in a public channel that only the attacker had joined. When a victim later asked Slack AI about their own private messages, it followed the instruction and showed a "reauthenticate" link carrying an API key from a private channel. The citation pointed only to the victim's channel.
Slack told the researchers this was intended behavior, since public channel messages are searchable by all workspace members.
Sources: PromptArmor; MITRE ATLAS AML.CS0035
Controls to start with
- Enforce tenant and document permissions inside the index query, server-side, down to the chunk level.LLM09:2026, mitigation 1
- Strip zero-width and hidden text before embedding, and record the source and trust tier of every vector.LLM09:2026, mitigation 2
- Keep external and internal confidential content in separate indexes.LLM09:2026, mitigation 3
- Delete embeddings when the source document is deleted, and treat vector backups like the source data.LLM09:2026, mitigation 5
Questions to ask vendors
Our suggestions, not taken from a framework.
- Does retrieval enforce the source system's permissions per user, and how is that tested?
- What content sources feed the index, and can outsiders add to any of them?
Sources
- OWASP Top 10 for LLM Applications 2026. OWASP GenAI Security Project, Aug. 3, 2026.
- OWASP Top 10 for Agentic Applications 2026. OWASP GenAI Security Project, Dec. 9, 2025.
- MITRE ATLAS data, release 2026.10. MITRE, Oct. 28, 2026.
- NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. National Institute of Standards and Technology, July 2024.
- EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System. Reddy and Gujral, arXiv:2509.10540, Sept. 6, 2025.
- CVE-2025-32711. NIST National Vulnerability Database, June 11, 2025.
- Data Exfiltration from Slack AI via indirect prompt injection. PromptArmor, Aug. 20, 2024.