OWASP Top 10 for LLM Applications, 2025
LLM08: Vector and Embedding Weaknesses
Vector and embedding weaknesses are flaws in how a retrieval-augmented generation system creates, stores or retrieves vectors and embeddings. OWASP says these flaws can be exploited, on purpose or by accident, to inject harmful content, skew outputs or expose sensitive information.
Vector and Embedding Weaknesses in more detail
Weak access controls can let the model retrieve and disclose data it should not. In a shared vector database used by several tenants, one group's data can surface in another's answers. Attackers may reconstruct much of the original source text from embeddings, and manipulated content added by insiders, seeded data or unverified providers can poison what is retrieved. The defenses are permission-aware vector stores, validated and authenticated data sources, careful review of merged datasets, and detailed retrieval logs. Posture and data protection tools are the categories we weigh for this risk.
The risk and its name come from OWASP; the summary, examples and controls on this page are our plain-English reading of OWASP's page. Source: Source, checked October 21, 2026: genai.owasp.org (opens in a new tab)
How it shows up
- Weak access controls let the model retrieve and disclose personal or proprietary data.
- In a multi-tenant vector database, one group's data appears in another group's responses.
- An attacker reconstructs much of the original text from stored embeddings.
- Manipulated content from an insider or an unverified data provider skews what is retrieved.
- Retrieved data conflicts with other sources, or with what the model learned in training.
Controls that reduce it
- Use fine-grained, permission-aware vector stores with logical and access partitioning between users and groups.
- Validate knowledge-base inputs, audit for hidden content, and accept data only from trusted, verified sources.
- Review merged datasets, and tag and classify data to control access.
- Keep detailed, tamper-resistant logs of retrieval activity to detect suspicious behavior.
Controls reduce risk, they do not remove it
No single control covers vector and embedding weaknesses on its own. Combine controls, and treat any tool as one layer.
Categories that address it
Our analysisThese are the directory categories whose tools we score on this risk. The mapping is our analysis.
Layers that address this risk
Our AI security layers are an editorial model, not a standard. Source states means OWASP's own text for LLM08 names the control the layer delivers. Our analysis means we drew the link.
- L2 Discovery and posture Our analysis
- L5 Data protection Source states
- L8 Monitoring and response Source states
Tools mapped to LLM08
Our analysis3 tools are mapped. Each tool is mapped only where a documented capability supports it. Open a tool page to see the capability and its source. Coverage Score compares tools within one category.
| Tool | Type | Deployment | Pricing model | OWASP risks | Coverage Score | Last reviewed |
|---|---|---|---|---|---|---|
| ProtectoProtecto · Data protection | Commercial |
| Paid |
| 70 out of 100 | |
| Pangea AI GuardCrowdStrike (Pangea) · Guardrails | Commercial |
| Not published |
| 48 out of 100 | |
| Lakera RedCheck Point (Lakera) · Red teaming | Commercial |
| Contact sales |
| 45 out of 100 |
No tools match these filters. Clear a filter to see more.
Why each tool is mapped
- Protecto: The vendor page says it protects data flowing through RAG pipelines and describes a policy layer with context-based access control. It does not mention vector stores or embeddings.
- Pangea AI Guard: The RAG ingestion recipe checks documents for injected instructions before indexing, the validation step OWASP LLM08 asks for.
- Lakera Red: The expert assessment tests indirect poisoning through RAG ingestion, the knowledge base poisoning path in LLM08.