Secrets inferred from embeddings
Statement (NASA form)
Given that embeddings of mail, notes, and records are stored more loosely than the text, there is a possibility of an attacker recovering private facts the system thought it had hashed away resulting in medical, legal, or political secrets leaving through a vector store.
A vector is not an anonymiser. It is a lossy copy.
Composite 12 = 3×3 + 3
Applicable mitigations
Controls · Short-lived, narrowly scoped tokens for every tool call · Mandatory secret scanning before a skill can be listed · No shared tool state across agent sessions · Hard fences on diagnosis, dosing, and triage language · Grounded, dated medical sources with uncertainty on the surface · Regulate high-stakes health modes as medical devices · A real off-ramp that still functions · Statutory independent safety function at designated labs