Research · curated 17 Aug 2026
A Security Analysis of Amazon S3 Vectors and Its Use in LLM Retrieval Pipelines
First reported offensai.com
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
Amazon S3 Vectors is being adopted as the storage layer for LLM retrieval pipelines, and this research shows a single API call or unvalidated write can poison RAG context into indirect prompt injection and agent command execution while leaving defenders blind in audit logs.
OFFENSAI and TUCN researchers analyzed Amazon S3 Vectors, AWS's native vector store for RAG pipelines, and demonstrated that its metadata is completely unvalidated on write, letting anyone with s3vectors:PutVectors forge chunk text, spoof citation URLs, rank-flood indexes, or overwrite legitimate chunks. In testing, a single planted vector drove a clinical RAG assistant to recommend a dangerous drug dose while citing an authentic PDF, and a poisoned chunk led to command execution in a tool-enabled agent's sandbox, with CloudTrail unable to reconstruct what changed.