Metadata Spoofing

The attacker forges the provenance of a document to impersonate a trusted internal source. This is not a network intrusion but a semantic attack on the agent's retrieval logic.

• Mechanism: Modifying the source or author metadata field to mimic a privileged internal wiki, a C-suite executive, or a verified code repository.
• Impact: The agent bypasses standard scrutiny because the context is tagged as originating from a high-authority namespace.
• Example: A scraped external PDF is injected into the vector store with the metadata source: internal-hr-policy-update, causing the agent to treat it as a binding directive.

This technique falsifies timestamps to exploit an agent's preference for recency. Agents often deprioritize older context to manage token budgets, making freshness a critical trust signal.

• Mechanism: Setting a malicious document's last_modified or created_at date to the current Unix timestamp.
• Impact: The poisoned document is sorted to the top of the retrieval stack, displacing legitimate historical records.
• Example: An attacker sets the timestamp of a malicious financial report to 2025-06-15T14:00:00Z, ensuring it is selected over the authentic report from the previous quarter.

The attacker alters the MIME type or file extension metadata to disguise an executable payload or a plaintext injection as a safe, parsable document.

• Mechanism: Changing the Content-Type header or the file_type metadata field from application/octet-stream to text/markdown.
• Impact: The agent's ingestion pipeline processes the file using a parser that interprets raw binary or control characters as valid tokens, leading to context corruption.
• Example: A malicious binary is labeled as application/pdf in the metadata. The agent's PDF parser fails, but the raw bytes are still ingested into the context window as garbled, potentially toxic tokens.

This attack fabricates a chain of cryptographic signatures or editorial review metadata to simulate a rigorous validation process that never occurred.

• Mechanism: Injecting fake signed_by or reviewed_by fields into the document header, referencing the identities of known automated validators or security bots.
• Impact: The agent's trust classifier sees a verified chain of custody and elevates the document's trust score to maximum.
• Example: A malicious code snippet is tagged with reviewed_by: static-analysis-bot and approved_by: security-team, causing the agent to execute it without sandboxing.

The attacker falsifies geolocation metadata to bypass data residency controls or jurisdictional access restrictions enforced by the agent's guardrails.

• Mechanism: Modifying geo_location or region tags to claim the data originates from an approved sovereign cloud region.
• Impact: The agent retrieves and processes data that violates compliance boundaries, believing it to be local.
• Example: A document hosted in a restricted external environment is tagged with region: eu-west-1 to match the agent's data residency policy, bypassing exfiltration controls.

The attacker injects a fake relevance or confidence score directly into the metadata to override the retriever's native ranking algorithm.

• Mechanism: Adding a field like relevance_score: 0.99 or vector_distance: 0.001 to the document metadata before ingestion.
• Impact: If the agent's retrieval pipeline naively trusts pre-computed metadata scores, the malicious document bypasses the semantic similarity check entirely.
• Example: A document with a cosine similarity of 0.2 to the query has its metadata overwritten to claim a similarity of 0.98, forcing it to the top of the retrieval results.