T18 · Helmwart ID · OWASP MAS Guide source
An attacker crafts retrieval inputs that surface flawed precedents from the vector store, so a retrieval-augmented agent approves a request on the basis of bad past examples.
ExtendsT2: Tool Misuse · base threat in OWASP v1.1 catalog
An attacker crafts an expense claim description that does not directly violate any policy rules but is semantically similar to approved claims in the vector store that should have been rejected. The Retrieval-Augmented Generation (RAG) system’s similarity search retrieves those flawed precedents, and the agent approves the new claim on that basis. The threat is distinct from T2 Tool Misuse, which involves direct commands; T18 manipulates the data used for retrieval rather than the tool invocations themselves.
In a Robotic Process Automation (RPA) expense reimbursement pipeline, the agent queries a vector store of previously approved claims to inform its approval decision. An attacker submits a claim for a “business development lunch” at an unusually high cost. The description is semantically close to a batch of incorrectly approved extravagant-meal claims already in the store. The similarity search surfaces those flawed precedents; the agent treats them as evidence that comparable claims are acceptable and approves the new one.
A second variant exploits date-format ambiguity: claims with unusual date strings cause the agent to misread the policy applicability period and approve expenses that fall outside the authorised window.
RAG-augmented agents do not re-evaluate policy rules from first principles on each request. They retrieve precedent. If past approvals were incorrect, or if the vector store has been seeded with examples that normalise borderline spending, the similarity mechanism actively works against the agent’s stated policy enforcement function. Autonomy compounds the risk: the agent acts on retrieved precedent without surfacing the retrieval decision to a human reviewer unless a separate threshold rule flags the claim amount. In a hierarchical multi-agent setup, a subordinate extraction agent may also normalise the description before the policy agent queries the vector store, amplifying the semantic drift.
Watch for RAG retrievals where the returned precedents semantically diverge from the current claim’s legitimate characteristics yet still drive an approval.
T18 extends T2 Tool Misuse. Where T2 targets tool invocations directly, T18 manipulates the data layer that informs retrieval, turning the RAG vector store into the attack surface. T49 (Semantic Drift in Expense Policy Embeddings) addresses the passive variant of the same surface: stale embeddings caused by operational neglect rather than adversarial shaping.
The Agentic Top 10 (ASI01 through ASI10) is a separate practitioner-facing publication that maps onto the master Threats & Mitigations threat numbering. T18 is covered by the following Top 10 entries:
An adversary writes malicious or misleading data into an agent's persistent memory or shared vector store, so that every future session, and every peer agent reading from the same store, operates on corrupted context. The defining difference from single-turn injection (ASI01) is that the poisoned data survives session reset; the agent's reasoning drifts without any new attacker input.
An attacker manipulates an agent's objective, task selection, or decision pathway (via injected prompts, deceptive tool outputs, forged peer messages, or poisoned retrieval data) so that the agent pursues the attacker's goal rather than the operator's. Unlike a single-turn injection, the harm compounds across many authorised steps before any drift is visible.
Source: OWASP Top 10 for Agentic Applications 2026 (Dec 2025) · the Top 10 is a compass into the master Threats & Mitigations taxonomy, not a replacement for it.
When T18 is present, these security design principles are the ones being violated or tested. Each links to the full principle; the mitigations below are how you restore them.
Auto-generated from the mitigation catalog: every mitigation whose coverage map includes T18, sorted by maturity tier (Tier 1 production-canonical first, then Tier 2, then Tier 3 research-stage).
When multiple agents share a single vector store, the access boundaries between them are not enforced by the store itself unless you configure them explicitly. Without per-namespace write and retrieval controls, an agent that can write to the shared corpus can insert crafted vectors into any namespace it can reach, and any agent that can query the store can retrieve another agent's confidential documents through embedding-space proximity. Shared-memory ACL addresses this by tagging every vector with a principal identifier at write time and filtering every retrieval query to the requesting agent's namespace, enforced at the gateway layer where the agent cannot bypass it.
why it helps RAG Input Manipulation requires write access to the shared retrieval corpus. Per-namespace write ACL removes that access from agents whose identity does not map to the target namespace, so a manipulated agent cannot insert adversarial vectors into a downstream agent's retrieval path.
A vector store returns results by embedding-space proximity, not by who is asking. Without a per-principal filter applied before similarity ranking, a query from tenant A can surface tenant B's vectors if the embeddings are close enough. Vector ACL closes that gap: every retrieval call is scoped to the requesting principal's namespace or payload partition before the store ranks any results, so cross-principal hits are structurally impossible rather than merely unlikely.
why it helps T18 RAG Input Manipulation describes an attacker injecting adversarial vectors into a shared retrieval corpus to influence a target agent's context. Scoping every query to the requesting principal's namespace means the attacker's injected vectors must reside in that same namespace to reach the agent, which requires write access to the target's namespace rather than to any shared partition.
The OWASP OWASP MAS Threat Modelling Guide v1.0 catalogues 1 named multi-agent variant of T18, anchored to specific MAESTRO layers. Each is a concrete attack pattern that emerges when this threat compounds across agents.
Adversary poisons a shared RAG store (T18); the injected context gradually shifts agent reasoning over time (T49); because logs are sparse or selectively pruned, the drift cannot be attributed after the fact (T8). Cross-layer: L2 data store, L3 agent reasoning, L5 observability.
Source: OWASP MAS Threat Modelling Guide v1.0, §2 Overview of MAESTRO Framework — Extended Threat Scenarios + Cross-Layer table.
MITRE ATLAS catalogues adversary techniques against AI systems. Where this OWASP threat has an attacker-perspective counterpart, the ATLAS technique is shown below. That is what a red team would actually be doing on the wire. Use this for detection-signal anchoring, threat-hunting hypotheses, and IR runbooks. Source: mitre-atlas/atlas-data v5.6.0.
© 2026 The MITRE Corporation. ATLAS content is reproduced and distributed with the permission of The MITRE Corporation.
AML.T0051.001LLM Prompt Injection: Indirectview on ATLAS ↗Adversary injects prompts via a separate data channel ingested by the LLM (databases, websites, documents) rather than directly in user input.
Agentic angle: Primary injection vector for RAG-backed agents: malicious text in retrieved context becomes instructions the model follows silently.
AML.T0070RAG Poisoningview on ATLAS ↗Adversary injects malicious content into documents indexed by a retrieval-augmented generation system so future queries surface attacker-controlled context.
AML.T0080AI Agent Context Poisoningview on ATLAS ↗Adversary contaminates an agent's context store (short-term scratchpad, vector memory, conversation history) so future reasoning is biased toward attacker goals.
Agentic angle: Persistent across sessions: a single successful poisoning influences every later decision until the memory is purged.
Adapted by Helmwart from the OWASP source(s) above underCC BY-SA 4.0(changes: normalized IDs, added MAESTRO-layer, agentic-factor, and mitigation mappings). This entry is licensed CC BY-SA 4.0.
Press play. The voice downloads once, then it’s cached.
On-device · private