ECHO

AI Memory & RAG Poisoning

Your AI remembers everything. ECHO decides what. Vector database attacks, embedding manipulation, retrieval poisoning, context window hijacking, and persistent memory corruption — weaponised for authorised red team engagements.

7
Subsystems
36
Techniques
211
Tests
View Documentation GitHub

Corrupt the Memory, Control the Model

ECHO targets the memory layer that RAG-augmented AI systems depend on. Poison the vector database and every retrieval returns your content. Manipulate embeddings and semantic search serves your payload. Hijack the context window and the model follows your instructions, not its own.

01

VECTOR

VECTOR DB ATTACKS

Inject malicious documents into vector stores. Similarity poisoning. Nearest-neighbour manipulation. Index corruption. Metadata tampering.

02

EMBED

EMBEDDING MANIPULATION

Adversarial embedding generation. Semantic space pollution. Cosine similarity exploitation. Dimension collapse attacks. Embedding inversion.

03

RETRIEVE

RETRIEVAL POISONING

Query manipulation. Relevance score gaming. Chunk boundary exploitation. Re-ranking attacks. Source authority spoofing.

04

CONTEXT

CONTEXT WINDOW HIJACKING

Context overflow attacks. Priority injection. Instruction smuggling via retrieved content. Attention steering. System prompt dilution.

05

PERSIST

MEMORY CORRUPTION

Persistent memory poisoning. Conversation history manipulation. Long-term memory injection. Memory consolidation attacks. Forgetting induction.

06

INJECT

KB INJECTION

Knowledge base poisoning. Document injection. Trusted source impersonation. Batch ingestion exploitation. Update pipeline attacks.

07

ANTIDOTE

MANDATORY RESTORE

Baseline capture before any engagement. Vector store snapshot. Embedding integrity verification. Signed restoration certificate.

UNLEASHED Gate

Standard mode detects. UNLEASHED exploits. Ed25519 crypto. Dual-gate safety. One operator.

Detection

Maps RAG attack surfaces. Identifies vulnerable vector stores and retrieval pipelines. No exploitation. Reports only.

Dry Run

Plans full poisoning campaigns. Shows exactly what would work. Ed25519 required. No execution.

Live Execution

Cryptographic override. Private key controlled. One operator. Founder's machine only.

THIS TOOL IS FOR AUTHORISED SECURITY TESTING ONLY. EVERY EXECUTION IS SIGNED AND LOGGED.

36
Techniques
211
Tests
7
Subsystems
49,301
Ecosystem Tests
Available On

Security Distros & Package Managers

Kali Linux
.deb package
Parrot OS
.deb package
BlackArch
PKGBUILD
REMnux
.deb package
Tsurugi
.deb package
PyPI
pip install

Your AI Remembers Everything. ECHO Decides What.

36 techniques. 7 subsystems. Vector poisoning. Embedding manipulation. Context hijacking. The tool that proves your RAG pipeline isn't safe.