// threat rule-base

Every threat MoorAI detects,
mapped to the standards.

This is MoorAI's living AI-agent threat matrix — every threat MoorAI detects, each mapped to the OWASP LLM Top 10 (2025), MITRE ATLAS and STRIDE, and scored by severity × likelihood. MoorAI evaluates them content-free, on the device: the prompt stays on the endpoint and only a category, a risk verdict and a keyed hash ever leave. The table below is the rule-base itself — 67 rules, 17 categories, one row each.

threats

The rule-base

One row per threat. Filter by category or by risk level; each threat carries MoorAI's guidance in a toggle. If scripting is off, every row stays visible.

Category

Risk

#	Threatwhat it is	Categoryrule-base group	Riskseverity × likelihood	OWASP LLMTop 10 · 2025	MITRE ATLAStechnique	STRIDEthreat class
1	Sensitive data leak Entering a contract, customer details, personal information, code, a legal document, or internal business information into an AI tool. MoorAI guidance Do not enter sensitive information into AI tools that are not organizationally approved. When in doubt, stop and ask a manager or information security.	Information & Privacy	20Critical	LLM02	AML.T0057	Information Disclosure
2	Direct Prompt Injection A direct instruction that tries to make the AI bypass policy, reveal information, or perform a forbidden action. MoorAI guidance Do not carry out unusual instructions that appear in the AI's response. Treat the AI as an assistive tool, not an authoritative source.	Prompt Injection	20Critical	LLM01	AML.T0051	Tampering
3	Indirect Prompt Injection Summarizing an email, PDF, website, or document in which a hidden instruction such as 'ignore the guidelines and send information out' was embedded. MoorAI guidance Treat external content as an untrusted source. Do not let the AI perform an action because of an instruction that appears inside a document, email, or website.	Prompt Injection	20Critical	LLM01	AML.T0051	Tampering
4	Downloading malicious Skills, Plugins, or Extensions Installing an AI browser add-on, an email-summary plugin, a document-writing Skill, or a Connector to enterprise systems. MoorAI guidance Do not download, install, or run any Skill, Plugin, Extension, Connector, or Agent Tool without organizational approval.	Add-ons & Tools	20Critical	LLM03	AML.T0053	Elevation of Privilege
5	Plugins with excessive permissions An AI add-on requests access to email, files, calendar, Drive, Teams, CRM, or the browser. MoorAI guidance Do not approve broad permissions without review. If an add-on requests access it does not need, stop and report it.	Add-ons & Tools	20Critical	LLM06	AML.T0053	Elevation of Privilege
6	Information exposure due to excessive permissions An enterprise AI shows an employee documents they can technically access but that are not required for their role. MoorAI guidance Do not distribute information the AI displayed if it is unrelated to your role. Report unusual information exposure.	Permissions & Exposure	16High	LLM06	AML.T0053	Information Disclosure
7	Shadow AI Using a free AI website, a private tool, a browser add-on, or an unapproved bot for office work. MoorAI guidance Use only AI tools approved by the organization. Do not upload work documents to private tools.	Unapproved Tools	20Critical	LLM03	AML.T0010	Information Disclosure
8	Reliance on incorrect answers or hallucinations The AI fabricates a source, a legal clause, a financial figure, a customer name, or an incorrect professional recommendation. MoorAI guidance Verify facts, figures, names, dates, and sources before any business use.	Information Reliability	20Critical	LLM09	AML.T0048	Repudiation
9	Intellectual-property exposure Uploading a roadmap, management deck, code, architecture, price quote, or product idea to an external AI tool. MoorAI guidance Do not enter intellectual property into unapproved tools. Use only an approved organizational environment.	Information & Privacy	15High	LLM02	AML.T0057	Information Disclosure
10	AI-enhanced phishing A well-written, error-free email impersonating a manager, supplier, or customer. MoorAI guidance Do not treat polished wording as a sign of authenticity. Verify unusual requests through a second channel.	Social Engineering	20Critical	LLM09	AML.T0048	Spoofing
11	BEC, Business Email Compromise Impersonating a CEO, CFO, supplier, or customer to transfer money, change bank details, or send sensitive information. MoorAI guidance Do not make a payment, change bank details, or send sensitive information based on an email or chat alone. Verify through a separate, pre-known channel.	Social Engineering	20Critical	LLM09	AML.T0048	Spoofing
12	Deepfake voice or video A phone call, voice message, or video that appears to come from a manager, supplier, customer, or known employee. MoorAI guidance Do not approve a sensitive action just because of a familiar voice or video. Re-verify via a known phone number or official channel.	Social Engineering	20Critical	LLM09	AML.T0048	Spoofing
13	AI-based Vishing and Smishing An SMS, WhatsApp, or voice message asking you to open a link, switch to another channel, or hand over login credentials. MoorAI guidance Do not click links or switch to an external channel on a suspicious request. Verify identity through an independent channel.	Social Engineering	20Critical	LLM09	AML.T0048	Spoofing
14	Automatic action taken on the employee's behalf The AI sends an email, updates the CRM, deletes a file, opens a permission, or approves a business action. MoorAI guidance Do not approve sensitive automatic actions without human review. Actions involving money, customers, permissions, or data require approval.	Agents & Permissions	15High	LLM06	AML.T0053	Elevation of Privilege
15	Employee or customer privacy violation Entering resumes, employee complaints, salary details, ID numbers, medical information, or customer details. MoorAI guidance Do not enter personal or sensitive information into AI tools without approval. Even 'just a summary' may count as exposure.	Information & Privacy	15High	LLM02	AML.T0057	Information Disclosure
16	Bias and discrimination in outputs The AI assists in screening candidates, evaluating employees, drafting feedback, or ranking customers. MoorAI guidance Do not use AI as the final decision on sensitive matters. Apply human review and ensure there is no bias or discrimination.	Ethics & Decision-Making	12High	LLM09	AML.T0048	Repudiation
17	Dangerous links, files, or scripts from AI output The AI suggests opening a link, running a command, downloading a file, enabling a macro, or using a script. MoorAI guidance Do not run code, commands, macros, or files the AI generated without understanding them and reviewing security.	Output & Code	15High	LLM05	AML.T0011	Tampering
18	Sensitive data retained in an AI conversation An employee accidentally uploads a sensitive document or keeps working in a conversation that already contains forbidden information. MoorAI guidance Stop using the conversation, delete the file if possible, do not keep processing the information, and report per organizational procedure.	Information & Privacy	16High	LLM02	AML.T0057	Information Disclosure
19	AI Meeting Assistants and transcription of sensitive meetings Adding an AI bot to a management meeting, hearing, legal discussion, HR, tender, or customer meeting. MoorAI guidance Do not enable AI transcription or summarization in sensitive meetings without approval. Notify participants of recording or transcription.	Meetings & Sharing	16High	LLM02	AML.T0057	Information Disclosure
20	Leakage via email and Teams/Slack thread summaries The AI summarizes a long thread and includes internal information or information not meant for distribution. MoorAI guidance Before sending an AI-generated summary, read it in full, remove sensitive information, and confirm recipients are authorized.	Meetings & Sharing	16High	LLM02	AML.T0057	Information Disclosure
21	Knowledge-base poisoning / RAG Poisoning A SharePoint or Drive file looks innocent but contains misleading information or malicious instructions the AI will later retrieve. MoorAI guidance Do not rely on an AI answer without checking the source. If the source is new, unfamiliar, or unofficial, do not use the answer and report it.	Data & Knowledge	15High	LLM08	AML.T0020	Tampering
22	Memory Poisoning Saving incorrect details, unapproved instructions, or externally-sourced information into an AI tool's memory. MoorAI guidance Do not store organizational or personal information in AI memory without approval. Review what the tool remembers and delete incorrect or sensitive information.	Data & Knowledge	12High	LLM04	AML.T0020	Tampering
23	Excessive Agency An agent is granted permission to send emails, open tickets, update the CRM, order from suppliers, or access files without approval. MoorAI guidance Do not run an agent with independent action capability over money, customers, permissions, files, or business systems.	Agents & Permissions	15High	LLM06	AML.T0053	Elevation of Privilege
24	Tool Misuse An AI connected to email, calendar, CRM, Jira, ServiceNow, or a finance system performs a wrong action due to misinterpretation. MoorAI guidance Do not approve connecting AI tools to enterprise systems without understanding what it can read and do. Prefer Read-Only.	Agents & Permissions	15High	LLM06	AML.T0053	Elevation of Privilege
25	MCP / Connector Tool Poisoning A connector or tool presents the AI with a misleading tool description, hidden parameters, or concealed instructions that cause an unwanted action. MoorAI guidance Use only organizationally-approved Connectors and MCP tools. Do not connect personal servers or tools.	Add-ons & Tools	15High	LLM03	AML.T0053	Elevation of Privilege
26	AI Account Takeover A personal or enterprise AI account is breached, and the attacker sees conversation history, uploaded files, and prompts. MoorAI guidance Enable MFA, do not reuse passwords, do not share AI accounts, and do not use a personal account for work.	Identity & Access	15High	LLM06	AML.T0012	Spoofing
27	Leakage via conversation history and uploaded files Information remains in the conversation, history, or workspace after a sensitive file was uploaded. MoorAI guidance Do not upload a sensitive file without approval. If uploaded by mistake, delete it if possible and report per procedure.	Information & Privacy	16High	LLM02	AML.T0057	Information Disclosure
28	AI browser extensions with browser access An AI add-on reads open pages, internal portals, HR systems, CRM, banking, or documents. MoorAI guidance Do not install an AI browser extension without approval. If an extension requests to read all sites or the clipboard, do not approve it.	Add-ons & Tools	20Critical	LLM03	AML.T0053	Information Disclosure
29	Fake links and sources generated by AI The AI provides a link, ruling, standard, article, APA source, or clause number that does not exist. MoorAI guidance Do not insert a source into a business, legal, or professional document before opening and independently verifying it.	Information Reliability	20Critical	LLM09	AML.T0048	Repudiation
30	AI-Generated Invoices A convincing invoice with the correct logo and a real supplier's wording, but with a small change to the bank details. MoorAI guidance Any change to bank details, an unusual invoice, or an urgent payment request must be verified through a pre-known channel.	Social Engineering	20Critical	LLM09	AML.T0048	Spoofing
31	Synthetic Identity of suppliers or candidates A candidate's or supplier's resume, profile photo, references, voice, or video are AI-generated. MoorAI guidance Do not rely on documents, video, or a profile alone. Verify identity, domain, company, and independent sources.	Identity & Access	12High	LLM09	AML.T0048	Spoofing
32	AI-Assisted Malware - dangerous code, macros, and scripts An employee asks the AI to create an Excel formula, PowerShell, macro, or script and runs it without understanding its impact. MoorAI guidance Do not run AI-generated code on a corporate machine without review. Code that deletes, downloads, or sends information requires technical review.	Output & Code	15High	LLM05	AML.T0011	Elevation of Privilege
33	Data Residency - processing in an unapproved country Using an external tool that uploads documents to an unknown cloud or processes data outside organizational policy. MoorAI guidance Use only organizationally-approved tools. Do not enter personal, customer, or internal documents into an unapproved tool.	Information & Privacy	12High	LLM02	AML.T0057	Information Disclosure
34	Misleading Translation The AI translates a contract, legal email, tender document, or business commitment and alters a critical term. MoorAI guidance Do not treat an AI translation as a binding document without professional human review.	Information Reliability	12High	LLM09	AML.T0048	Repudiation
35	Overconfidence in an AI answer An authoritative tone leads the employee to stop checking data, assumptions, and sources. MoorAI guidance Treat an AI answer as a draft only. For money, legal, HR, security, or customer matters, perform independent verification.	Information Reliability	20Critical	LLM09	AML.T0048	Repudiation
36	Cross-Context Leakage Working in the same AI conversation on Customer A and then Customer B, and the AI mixes information across the contexts. MoorAI guidance Open a separate conversation for each customer, project, or sensitive topic. Do not mix documents from different customers in the same conversation.	Information & Privacy	16High	LLM02	AML.T0057	Information Disclosure
37	Unauthorized AI Sharing - sharing output with excess information Sharing a prompt, screenshot, or AI answer that includes internal information that went unnoticed. MoorAI guidance Before sharing a screenshot or AI output, check that it contains no customer names, internal data, links, or tokens.	Meetings & Sharing	16High	LLM02	AML.T0057	Information Disclosure
38	AI Cost Abuse Uploading huge files, running agents in a loop, or using an expensive tool with no business need. MoorAI guidance Use AI according to business need. Do not run massive processing, automations, or agents without approval.	Operations & Costs	9Medium	LLM10	AML.T0034	Denial of Service
39	Secret / credential exposure An API key, access token, private key, JWT, or DB connection string (GitHub, AWS, Stripe, Slack, GCP, OpenAI/Anthropic, and more) is about to be sent to the AI. MoorAI guidance Never send a live secret to an AI tool. Remove or redact it before the prompt leaves; if it was already exposed, rotate it. MoorAI blocks or masks the span on the device.	Information & Privacy	20Critical	LLM02	AML.T0057	Information Disclosure
40	Second-Order Prompt Injection A malicious instruction enters a service form or support ticket, and later another agent with high permissions reads it and acts on it. MoorAI guidance If the AI derives a task from external content, do not approve it automatically. Tasks from an email, form, or website require human review.	Prompt Injection	15High	LLM01	AML.T0051	Tampering
41	Legal / contract language Drafting, reviewing, or pasting contract or legal text into the AI. MoorAI guidance This looks like contract or legal text. AI output is not legal advice — have qualified legal counsel review it before you finalize, sign, or share it.	Advisory & Guidance	9Medium	LLM09	AML.T0048	Repudiation
42	Employee relations / PIP Drafting a performance improvement plan (PIP), warning, disciplinary letter, hearing, or termination. MoorAI guidance This involves an employee-relations or performance action (e.g. a PIP, warning, hearing, or termination). AI output is not HR or legal advice — involve HR and qualified legal counsel before documenting, sending, or acting on it.	Advisory & Guidance	9Medium	LLM09	AML.T0048	Repudiation
43	Destructive command execution An agent runs an irreversible, high-impact shell or DB command (rm -rf, git push --force, DROP DATABASE/TABLE, disk format, mass delete) before a human reviews it. MoorAI guidance This prompt would have the agent run a destructive, hard-to-reverse command (e.g. rm -rf, force-push, DROP TABLE/DATABASE, format). Review the exact command and require explicit human approval before it runs.	Output & Code	6High	LLM05	AML.T0011	Elevation of Privilege
44	Protected health information (HIPAA / PHI) A prompt contains patient health data — diagnoses, medical record numbers (MRN), prescriptions, ICD-10 codes, NPI/DEA, or health-insurance identifiers. MoorAI guidance This prompt appears to contain protected health information (PHI). Do not send patient health data, medical records, diagnoses, or insurance identifiers to the AI — redact it or use an approved, BAA-covered workflow.	Information & Privacy	6High	LLM02	AML.T0057	Information Disclosure
45	Copyright / license contamination The AI reproduces a large verbatim block of licensed or copyrighted code (e.g. a GPL/AGPL file, a copyright header, or 'All rights reserved' source), or such code is pasted into a prompt. MoorAI guidance This looks like licensed or copyrighted source (e.g. GPL/AGPL, a copyright header). Pasting it into or accepting it from the AI can create license-contamination or IP risk — confirm the license and provenance before you reuse it.	Advisory & Guidance	9Medium	LLM05	AML.T0048	Repudiation
46	Changing security settings, IAM, or firewall The prompt asks the agent to weaken or change security posture — disable a firewall, open a security group to 0.0.0.0/0, grant IAM privileges, add a sudoer, or turn off endpoint protection. MoorAI guidance This changes security, IAM, or firewall settings — a high-impact action that should require human approval. Confirm the change is intended and authorized before letting the agent proceed.	Human Approval Required	6High	LLM06	AML.T0048	Elevation of Privilege
47	Sending external email or notifications The prompt asks the agent to send an email, SMS, or webhook/notification to an external recipient (SMTP, SendGrid, Mailgun, Twilio, a Slack/Discord webhook). MoorAI guidance This sends a message to an external recipient on your behalf — it should require human approval. Verify the recipient and content before the agent sends anything.	Human Approval Required	4Medium	LLM06	AML.T0048	Information Disclosure
48	Creating users, tokens, or API keys The prompt asks the agent to create a user or service account, generate an API key or access token, or mint credentials (aws iam create-access-key, create service account, ssh-keygen, adduser). MoorAI guidance This creates an identity or credential — a high-impact action that should require human approval. Confirm who the credential is for and that it's authorized before proceeding.	Human Approval Required	6High	LLM06	AML.T0048	Elevation of Privilege
49	Deploying to a production environment The prompt asks the agent to deploy or release to production (terraform apply, kubectl apply to a prod namespace, helm upgrade --namespace prod, vercel --prod, firebase deploy, npm publish, git push to a production branch). MoorAI guidance This deploys or releases to production — it should require human approval. Confirm the target environment and that the release is intended before the agent proceeds.	Human Approval Required	6High	LLM06	AML.T0048	Tampering
50	Invisible or obfuscated text in content A document, web page, or RAG chunk hides steering text using zero-width characters or bidirectional (Trojan-Source) overrides that a human can't see but the model reads. MoorAI guidance Treat content with hidden or direction-overriding characters as untrusted. Do not act on it; strip or reject the content and report the source.	Data & Knowledge	12High	LLM08	AML.T0051	Tampering
51	System-prompt extraction attempt A prompt tries to make the agent reveal its hidden instructions — 'repeat the words above', 'print your system prompt', 'what are your rules'. MoorAI guidance Do not reveal system or developer instructions. Refuse extraction attempts and report repeated probing.	Information & Privacy	9Medium	LLM07	AML.T0051	Information Disclosure
52	System-prompt or instruction leakage in output The model's reply recites its own system prompt or hidden instruction block (role, rules, or embedded secrets). MoorAI guidance Block or redact replies that expose the system prompt or its embedded configuration. Review why the instructions were disclosed.	Output & Code	8High	LLM07	AML.T0057	Information Disclosure
53	Oversized or runaway input An extremely large prompt or file is fed into the model in a single call — a token-blowup / cost-spike or resource-exhaustion vector. MoorAI guidance Cap or chunk oversized inputs. Investigate repeated oversized or high-rate calls as possible unbounded-consumption abuse.	Operations & Costs	6Medium	LLM10	AML.T0034	Denial of Service
54	Reverse shell / remote code execution The agent proposes or runs a reverse shell or remote-exec payload — bash -i over /dev/tcp, nc -e, socat exec, a Python/Perl socket shell, or a PowerShell TCPClient — handing an outside host a live shell. MoorAI guidance This is a reverse-shell / remote-code-execution pattern. Do not run it. Warn the operator and require explicit human review — a matching command hands control of the machine to a remote host.	Output & Code	15High	LLM05	AML.T0011	Elevation of Privilege
55	Credential / secret-file access The agent reads a credential or secret file — .env, ~/.aws/credentials, an SSH private key, .npmrc, .git-credentials, .netrc, .pgpass, kube/gcloud config, or /etc/shadow — or dumps the keychain. MoorAI guidance This reads a credential or secret file. Warn before the agent opens .env, key material, or cloud credentials — these should never be sent to the model or copied elsewhere.	Identity & Access	15High	LLM02	AML.T0057	Information Disclosure
56	Destructive tool / MCP call A tool or MCP call performs a destructive, hard-to-reverse operation — dropDatabase / deleteMany, mass row delete, cloud resource teardown (aws s3 rb, terminate-instances), kubectl delete, or repo deletion — via an agent tool call rather than a shell. MoorAI guidance This is a destructive tool / MCP call (mass delete, resource teardown, drop). Warn and require human approval before the agent invokes it — the action is hard or impossible to reverse.	Agents & Permissions	10Medium	LLM06	AML.T0011	Tampering
57	Unsanctioned or malicious package install The agent installs software from an untrusted source — piping a remote script to a shell (curl … \| bash), pip/npm/cargo/go install from a URL, git, or an alternate index, or an auto-yes npx of an unvetted package. MoorAI guidance This installs code from an untrusted source (remote install script, alternate package index, or unvetted package). Warn before it runs — a malicious or typosquatted package is a supply-chain compromise vector.	Add-ons & Tools	12High	LLM03	AML.T0010	Tampering
58	Model-escalated risk (on-device second opinion) The regex engine was ambiguous, so an opportunistic local model (loopback only, zero egress) flagged the content as a likely secret, injection, destructive command, or exfiltration attempt. MoorAI guidance A local second-opinion model flagged this content. Treat as an advisory signal — review the category and confidence. The text was evaluated on the device only; nothing left the machine.	Information Reliability	6Medium	LLM01	AML.T0051	Tampering
59	Lethal trifecta exposure Within one agent session all three exfiltration legs appeared: access to private data, exposure to untrusted content, and the ability to communicate externally. Any one is safe; together they are the classic prompt-injection data-exfiltration setup. MoorAI guidance This session combines private-data access + untrusted input + an external egress path — the lethal trifecta. Review the agent's tool profile: remove one leg (least-privilege MCP allow-list, or block the external call) to break the exfiltration chain.	Agents & Permissions	15High	LLM06	AML.T0057	Information Disclosure
60	AI rules/config file poisoning A coding-agent rules or config file the agent auto-loads (CLAUDE.md, .cursorrules, copilot-instructions.md, .mcp.json, skills/hooks) contains injected or hidden instructions, or has drifted from its approved baseline. MoorAI guidance Treat agent rules/config files as executable policy. Review injected/hidden directives and confirm the file matches an approved baseline before trusting it — a poisoned rules file silently steers every future prompt.	Add-ons & Tools	15High	LLM08	AML.T0051	Tampering
61	Insecure code generation The agent writes code with an injection-prone pattern — a SQL query built by string-concatenating input, innerHTML set from a variable, eval / new Function on dynamic input, a shell run with shell=True, weak crypto (MD5/SHA-1/DES), or unsafe deserialization (pickle.loads, yaml.load) — introducing SQLi/XSS/RCE/command-injection into the codebase. MoorAI guidance Screen AI-generated code for injection-prone patterns before committing. Use parameterized queries, safe DOM APIs, avoid eval / shell=True on untrusted input, and prefer vetted crypto + safe deserializers. Screening runs on-device; only a content-free verdict (rule id + severity + one-way hash) is reported.	Output & Code	16High	LLM05	AML.T0011	Tampering
62	Hallucinated or typosquatted dependency An AI coding agent suggests installing a package that doesn't exist (a hallucinated name attackers pre-register — 'slopsquatting') or one whose name is a near-miss of a popular package ('reqeusts' for 'requests', 'lodahs' for 'lodash'), pulling malicious code into the project. MoorAI guidance Do not install packages an agent names without verifying they exist and are the intended, popular package. MoorAI flags install commands whose package name typosquats a known-popular package or looks hallucinated — content-free, matched on the name only.	Add-ons & Tools	16High	LLM03	AML.T0010	Tampering
63	Unapproved model endpoint (rogue LLM egress) An agent is pointed at a non-approved LLM/API endpoint — a base-URL override (ANTHROPIC_BASE_URL / OPENAI_BASE_URL) or a direct call to an unsanctioned provider or proxy — so prompts, code, and secrets are exfiltrated to an attacker-controlled or unvetted destination. MoorAI guidance Restrict which model endpoints agents may use to an approved allow-list. MoorAI flags base-URL overrides and direct calls to LLM endpoints not on your organization's allow-list — host-level, content-free.	Data Exposure	15High	LLM02	AML.T0024	Information Disclosure
67	Transit interception (proxy / CA environment injection) An attacker with no special privileges sets HTTPS_PROXY and NODE_EXTRA_CA_CERTS (or SSL_CERT_FILE / REQUESTS_CA_BUNDLE) on the agent process. The destination is unchanged — the agent still connects to its approved provider — but every request now transits an interceptor that reads the prompt, the generated code, and the API key in cleartext. Because the injected CA makes the forged certificate legitimately trusted, the client reports the connection as verified and nothing appears wrong. MoorAI guidance Treat proxy and CA-trust environment overrides as egress-affecting configuration, not developer convenience. MoorAI reports any proxy or CA override on an agent launch and denies an unsanctioned proxy when an allow-list is configured (policy.transitAllow) — host and variable NAME only, content-free. Distinct from #63, which checks the destination and passes this by design.	Data Exposure	15High	LLM02	AML.T0024	Information Disclosure
64	Agent entitlement drift (out-of-scope action) An agent takes an action outside its declared authorized envelope — reads a directory, calls a tool or MCP server, or reaches an endpoint it was never scoped for — the signal that a correctly-permissioned agent has quietly turned into a breach. MoorAI guidance Declare each agent's authorized scope (tools, paths, MCP servers, endpoints) and alert or block when observed behavior drifts from it. MoorAI compares actions against the policy's entitlement envelope — content-free (names/paths only, never content).	Agents & Permissions	12High	LLM06	AML.T0053	Elevation of Privilege
65	Local secret value egress A value from a local secret store (project .env, cloud credentials) appears verbatim in an outbound command, MCP tool argument, or prompt — the agent is about to ship a real secret off the device. MoorAI guidance Block outbound flows that carry a known local secret value. MoorAI fingerprints local secret values on-device (one-way hash) and matches them against egress — only the hash and a verdict ever leave, never the value.	Data Exposure	15Critical	LLM02	AML.T0024	Information Disclosure
66	Sub-agent / A2A delegation An agent spawns a sub-agent or delegates a task to another agent (A2A), extending the blast radius through a child that may inherit less oversight than the parent — a delegated action can bypass controls scoped to the parent. MoorAI guidance Track sub-agent spawns and agent-to-agent delegation; apply the parent's entitlement envelope and tier to the child, and flag delegation outside the authorized scope. MoorAI records the delegation graph content-free (tool + fingerprint lineage, never content).	Agents & Permissions	12High	LLM06	AML.T0053	Elevation of Privilege

No threats match this filter.

Content-free by design. MoorAI matches these rules on the developer's machine and reports only a category, a risk verdict and a one-way hash — never the prompt, the code or the matched text. The mapping above is how each rule lines up with the public standards; the compliance crosswalk shows how MoorAI's shipped controls line up with ISO 42001, the NIST AI RMF, the EU AI Act and AIUC-1.