RAG & Vector Store Penetration Testing
Retrieval-augmented generation makes your knowledge base part of your attack surface. Whatever the model retrieves, it tends to treat as fact, so an attacker who can influence that content can influence your AI's answers without ever talking to it. We test whether your retrieval pipeline can be poisoned, whether it leaks between customers, and whether it exposes more than it should.
What We Test
Knowledge base poisoning: If an attacker can write to any source your model retrieves from (support docs, tickets, reviews, a wiki), we verify whether they can plant instructions that your assistant follows as if they were policy.
Cross-tenant leakage (OWASP LLM08): We test whether retrieval can surface another customer's data, and whether tenant isolation holds under adversarial queries.
Over-indexed internal data: We check whether internal, employee-only, or confidential documents became retrievable through your RAG pipeline by mistake, a failure pattern seen repeatedly in real deployments.
Embedding weaknesses: We assess whether sensitive source text can be reconstructed from stored embeddings, and whether retrieval ranking can be manipulated so attacker-chosen content always wins.
Why It Matters
Your RAG pipeline makes trust decisions on every query. A poisoned source does not look like an attack: it looks like a normal document giving the model confident, wrong instructions. The result can be wrong refunds, wrong compliance answers, or leaked data, all traced back to content nobody reviewed.
Deliverables
Findings report: Mapped to the OWASP Top 10 for LLM Applications and MITRE ATLAS.
Data governance review: What is indexed, what should not be, and how to fix the pipeline.
Prioritized remediation: From source validation to tenant isolation.
Put Your AI Features to the Test
Contact us today to scope an AI penetration test. We will walk you through the realistic attack paths against your deployment and where untrusted input meets something that matters in your application.