PUBLIC-EVIDENCE TOPIC COLLECTION
RAG security cases covering retrieval authorization, vector databases, poisoned content, cross-user data, prompt-layer compromise, and cloud takeover paths.
9 matched references · all link to complete source and scoring records
Retrieval-augmented generation adds ingestion, storage, ranking, authorization, and prompt assembly to the model boundary. A meaningful RAG evaluation must test those components as one system and preserve tenant, provenance, and instruction-trust information end to end.
Framework routes: OWASP LLM Top 10 · NIST AI RMF. External frameworks guide threat, control, and evidence selection; measured deployment evidence determines AITBM scores.
Use these records as incident references, test-design inputs, and examples of evidence-to-rubric reasoning. They are retrospective scenarios, not current vendor ratings or assessments of record.
2026-08-06 · RAG / Retrieval-Augmented System
Self-replication is what separates Morris II from an ordinary RAG injection in AITBM terms: output that re-enters other assistants' retrieval stores corroborates Cp at 1.00 through unbounded fan-out and meets the BAW closed-feedback-loop item, even though the architecture is plain RAG with no tools.
Indicative ERS 6.3 · 3.1–9.5
2026-08-06 · RAG / Retrieval-Augmented System
Access control held and still leaked: Slack AI honoured every channel permission, which earns Cn-1 its 0.50, yet one authenticated member's public post steered the victim's authorised context into disclosing a private secret, so the loss is scored where it occurred — Ro-4, Pr-1 and Cn-3 — rather than in the permission model.
Indicative ERS 3.5 · 1.6–5.3
2026-08-05 · RAG / Retrieval-Augmented System
Orca found Internet-exposed vector databases containing source text, personal data, medical records, credentials, and internal configuration, then validated that credentials from one support-ticket index could reach external SaaS systems. Separately, two critical Milvus vulnerabilities bypassed authentication through a trusted sourceID header and unauthenticated APIs on port 9091. Together, the findings show that a vector database is both a sensitive data store and an AI infrastructure control boundary.
Research note · no ERS
2026-08-02 · RAG / Retrieval-Augmented System
When the exfiltration hop is a user-followed link rather than an automatic fetch, the risk moves out of Autonomy Amplification (0.00) and into Robustness and Output Filtering, so a purely conversational assistant can still carry an injection failure on two anchors without any action authority at all.
Indicative ERS 4.4 · 1.6–7.2
2026-08-02 · RAG / Retrieval-Augmented System
Crediting a held control once and only once: Bard's CSP genuinely forced a bypass and earns Cn-1 its 0.50, but because it governs destinations rather than output content it does not also lift Cn-3, where the conversation-bearing URL rendered unexamined at 0.25.
Indicative ERS 4.3 · 1.6–7.0
2026-05-26 · RAG / Retrieval-Augmented System
Remediation Feasibility sits at its bottom anchor — a patchable ordering bug with a CVE and a fixed release — while Cascade Potential still forces 1.00, which is exactly the layer separation AITBM is built for: how easily a defect is fixed and how far it reaches are scored independently, so a cleanly patchable flaw never gets to look harmless.
Indicative ERS 4.8 · 2.7–6.9
2026-04-29 · RAG / Retrieval-Augmented System
An incident with no established root cause is still scorable — the enforced boundary and the missing release gate are directly observable from the outcome — and the unresolved mechanism belongs in ACI (thin coverage, a critical-invariant C_event cap) rather than being smoothed over with invented sub-metric scores; it is also the clearest example of a 'default' Cp, where 1.00 comes from the missing dependency graph and not from the impact.
Indicative ERS 3.5 · 1.4–5.6
2026-04-23 · RAG / Retrieval-Augmented System
This is the batch's clearest demonstration that a control which held still gets scored, and scored up: CSP blocked the direct egress domain and the XPIA classifier forced the attacker to craft plain prose, which is exactly why Cn-3 and Cn-1 sit at 0.50 and Ro-1 at 0.40 rather than at failure anchors — and the residual risk is carried instead by Cp, where a single demonstrated chain crossing a declared-blocked boundary invalidates that gate's containment claim and corroborates the 1.00 anchor.
Indicative ERS 4.3 · 1.9–6.7
2026-04-17 · RAG / Retrieval-Augmented System
The sub-metric that should have stopped this is Ro-4, not a web-application control: once the prompt and retrieval tables were writable, the AI platform's integrity depended on chunk and configuration signing that did not exist - and AITBM scores that AI asset store, not the endpoint. The case also shows the attacker's autonomy must not leak into the victim's architecture class; Lilli is RAG, and classifying it as agentic because CodeWall's agent was would have silently changed the intra-axis weight set.
Indicative ERS 4.5 · 2.2–6.7
Each record distinguishes observed controls, missing evidence, architecture-based exclusions, operational risk, confidence limits, and the uncertainty interval. When using a case as a reference, compare the documented path to your own system boundary and rerun the applicable test methods rather than copying its indicative ERS.
