domains / families / security / assessing-vector-and-embedding-weaknesses

assessing-vector-and-embedding-weaknesses

separate

Test RAG vector stores (Pinecone, Qdrant, Weaviate, Chroma, pgvector,

When to use

• During a security assessment of any RAG / vector-search application (OWASP LLM08 coverage).
• When a vector store is multi-tenant and you must prove namespace/metadata isolation.
• When the corpus accepts user-supplied or third-party documents (poisoning surface).
• When the embedding endpoint is externally reachable (inversion/membership surface).
• When validating retrieval-filtering controls before go-live.

When not to use

• embedding inversion against systems you do not control
• cross-tenant probing against systems you do not control
• testing against production corpus

Skill page

Source