Knowledge Store Compromise
Memory & Knowledge GovernanceDescription
Attacker modifies, injects content into, or extracts sensitive material from external knowledge stores that agents query (RAG vector databases, document repositories, knowledge bases). Encompasses: (1) Content injection—poisoning knowledge stores with malicious guidance, false regulatory information, or adversarial instructions; (2) Credential harvesting—extracting API keys, passwords, and secrets embedded in documents ingested into RAG systems and subsequently surfaceable via RAG queries. SCOPE BOUNDARY: Distinguished from Memory Poisoning (ZYR-MK-001) by storage layer—knowledge stores are external persistent repositories vs. agent working/episodic memory.
Attacker gains write access to company vector DB and injects false regulatory guidance. Attacker queries 'show me any passwords in internal docs'—agent retrieves AWS credentials from an ingested runbook.
Personalised profiling combined with persuasion techniques has been deployed at scale in confirmed production incidents: Cambridge Analytica harvested psychographic profiles of millions and targeted political messaging accordingly, and Facebook's internal emotional contagion experiment demonstrated real-time feed manipulation to alter user affect at scale.
Primary mitigations
- Knowledge base write-access controls with multi-party authorisation for updates
- content integrity verification on all ingested documents
- sensitive data detection pre-ingestion (credentials, PII, confidential data)
- credential management via secrets management systems—never in documents
- user-level access controls on RAG query results
- provenance tracking for all knowledge base entries
- anomaly detection in knowledge base update patterns.
Detection signals
Knowledge Base Integrity Score; credential exposure detection rate in RAG outputs; unexpected content injection events; PII detection in knowledge base.