There are 6 attacks in the rag-exploitation category. Each shows its technique id, mode, standards mapping, description, and the exact command to run it (swap the provider and target as needed).
​
critical
black-hole · tool-use · OWASP: LLM09, LLM01 · MITRE: AML.T0070, AML.T0099Writes vectors near the geometric centroid of the embedding space so hubness makes them retrieved for almost any query, pulling generation toward attacker content. Requires write access to the vector store; it is a retrieval-layer attack, not an embedding model compromise.Run it:
​
critical
knowledge-base-poisoning · tool-use · OWASP: LLM09, LLM03 · MITRE: AML.T0020, AML.T0051.000Tests if an agent can be tricked into writing adversarial content into the knowledge base that affects future retrievalsRun it:
​
high
embedding-collision · single-turn · OWASP: LLM09 · MITRE: AML.T0043.003, AML.T0068Exploits embedding model weaknesses where semantically different texts produce similar vectors, allowing adversarial retrievalRun it:
​
high
retrieval-manipulation · tool-use · OWASP: LLM01, LLM09 · MITRE: AML.T0051.000, AML.T0068Manipulates RAG retrieval by crafting queries that surface poisoned or adversarial documents from the vector storeRun it:
​
medium
chunk-boundary-exploit · single-turn · OWASP: LLM09 · MITRE: AML.T0054, AML.T0068Exploits document chunking boundaries in RAG systems where safety-critical context gets split across chunksRun it:
​
medium
citation-hallucination · single-turn · OWASP: LLM07, LLM09 · MITRE: AML.T0054, AML.T0068Tests if a RAG system fabricates citations or attributes harmful content to legitimate retrieved sourcesRun it: