Hunt Agent RAG / Vector-Store Attacks

RAG is the most common enterprise agent pattern: the agent answers from a vector store / knowledge base. Four attack surfaces: the ingestion pipeline (poison what gets indexed), retrieval (manipulate ranking, cross the tenant boundary), the embedding layer (invert/leak), and the retrieved content itself (indirect injection when the model treats chunks as instructions). The two crown-jewel outcomes: cross-tenant document access (an IDOR at the embedding layer) and corpus poisoning that hits every user who later retrieves the planted chunk.

Where This Lives / Attack Surface Signals

• Agent cites sources / "based on the knowledge base / according to the docs".
• Ingestion you can influence: user uploads, crawled web pages, shared drives, email/tickets/PRs, connectors (Confluence/SharePoint/Drive).
• A shared index vs per-user/tenant partitioning.
• Any endpoint returning embeddings/vectors or raw similarity scores.
• Retrieved chunks fed into the prompt as context (indirect-injection channel).

Crown Jewel Targets

• Cross-tenant retrieval: the vector store isn't partitioned (or metadata filters aren't enforced) → tenant A's query returns tenant B's documents. IDOR at retrieval.
• Corpus poisoning: an attacker-controllable ingestion path lets you plant a chunk that poisons every user who retrieves it (overlaps hunt-agent-memory-poisoning cross-user).
• Embedding inversion: exposed vectors reconstructed back to source text / membership inference on the private corpus.