A SECURITY ANALYSIS OF AMAZON S3 VECTORS AND ITS USE IN LLM RETRIEVAL PIPELINES

Summary from the TLDR InfoSec newsletter

An attacker holding only s3vectors:PutVectorBucketPolicy permissions can grant foreign AWS accounts full data-plane access to forge chunk text, spoof citation URLs, and manipulate embedding coordinates so poisoned data dominates top-K retrieval. Researchers demonstrated that a single planted vector could trick a clinical RAG assistant into recommending dangerous medical dosages alongside authentic citations or even achieve command execution in tool-enabled agents. CloudTrail data events for these actions are disabled by default and strip critical metadata when enabled, so defenders must isolate ingestion behind strict IAM roles, utilize HMACs for chunk keys, and mandate manual confirmation before autonomous agents execute actions.