 An attacker supplies carefully crafted payloads to perform reconnaissance from error messages.  It then exploits known third-party vulnerabilities to execute code and perform data exfiltration or privilege escalation A plugin used to retrieve embeddings from a vector store accepts configuration parameters as a connection string without any validation.  This allows an attacker to experiment and access other vector stores by changing names or host parameters and exfiltrate embeddings they should not have access to A plugin accepts SQL WHERE clauses as advanced filters, which are then appended to the filtering SQL.  This allows an attacker to stage a SQL attack An attacker uses indirect prompt injection to exploit an insecure code management plugin with no input validation and weak access control to transfer repository ownership and lock out the user from their repositories.  OWASP