OWASP's first risk taxonomy written for autonomous, tool-using agents — goal hijack, tool misuse, unexpected code execution, memory poisoning, rogue agents — is where buyers and auditors now start the agent-security conversation. MoorAI was built for exactly this surface: the coding agent's in-process tool call, decided on the device. Below is an architecture-level alignment of MoorAI's 67-threat matrix to each ASI item — not an OWASP-certified mapping, and honest where an item belongs to the identity, orchestration, or model layer rather than the endpoint.
The model layer decides what an agent wants; the tool layer decides what it can — and only the second is enforceable. Most of the agentic Top 10 lives at that second layer, at the moment a tool call is about to run. That is where MoorAI sits, on the machine, before execution, emitting only category · risk · keyed one-way hash.
| Risk | What it is | How MoorAI aligns |
|---|---|---|
| ASI01Agent Goal Hijack | An attacker alters the agent's objective through malicious content — a poisoned rules file, a prompt-injection payload, or instructions hidden in something the agent later reads. | Direct control Content-free rules-file analysis ( CLAUDE.md, .cursorrules, skill files), multilingual prompt-injection detection (~29 languages), and second-order / indirect-injection detection in files, RAG payloads, and OCR'd images — caught before the instruction can steer the agent. |
| ASI02Tool Misuse & Exploitation | The agent uses legitimate tools in unsafe ways — over-broad arguments, a destructive command, a tool call that does more than the task needed. | Direct control The PreToolUse hook evaluates every tool call on the device before it runs, with per-tool MCP argument rules and destructive-command detection. One of MoorAI's deepest areas — enforced today on Claude Code; Codex and Copilot CLI are detection-only. |
| ASI03Identity & Privilege Abuse | Agents inherit or escalate high-privilege credentials — over-scoped tokens, standing secrets, access that outlives the task. | Adjacent MoorAI blocks secrets from being read into agent context and constrains reach with a per-agent entitlement envelope and destination map. It governs the action, not the credential lifecycle — token issuance, rotation, and just-in-time scoping belong to a non-human-identity (NHI) product. Run MoorAI as the action-layer complement to one, not a replacement. |
| ASI04Agentic Supply-Chain Vulnerabilities | Compromised or unvetted MCP servers, plugins, skills, models, or extensions entering the agent stack — the way the first malicious MCP server reached real machines in 2026. | Direct control An approved-MCP allow-list enforced at call time, per-tool argument rules, content-free Skill Analysis, and an on-device AIBOM inventorying models, MCP servers, tools, and skills with capability-scope risk (network / filesystem / credential). A clean server that ships one exfil line in a later release is blocked at the call, not trusted by reputation. |
| ASI05Unexpected Code Execution | The agent generates or runs code and shell commands unsafely — curl | bash, an unreviewed script, a command with a scope nobody intended. |
Direct control Bash / shell interception at the tool-call boundary, before execution, with destructive-command and risky-pattern detection. The decision is made in-process, so a command that never generates network traffic is still governable. |
| ASI06Memory & Context Poisoning | Attackers poison the agent's memory or its RAG / index so a planted directive fires on a later read and steers future behavior. | Direct control Secret-read-into-context blocking, content-free rules- and skill-file analysis, and on-device RAG / index inspection — hidden-instruction and invisible-text detection (zero-width, bidirectional / Trojan-Source characters) in retrieved content. Second-order injection is caught at the read, not just the prompt. |
| ASI07Insecure Inter-Agent Communication | Multi-agent systems face spoofing and tampering across the channels agents use to talk to each other and to tool servers. | Partial MoorAI governs the tool-call surface each agent uses — the MCP allow-list at call time, per-tool argument rules, and lethal-trifecta / cross-server toxic-flow detection. Full agent-to-agent (A2A) channel authentication and message integrity across an orchestration is broader than one endpoint's view; MoorAI covers the tool-boundary slice of it, not the whole protocol. |
| ASI08Cascading Failures | A small error propagates across planning and execution — one bad step compounding through connected agents and systems. | Detect & reconstruct Per-agent assurance score, machine-speed burst / loop detection via the autonomous-agent-behavior signature, and content-free trace / session replay that reconstructs the full action chain for investigation without surfacing a prompt. MoorAI flags and records runaway behavior; multi-agent orchestration-level failure isolation sits above the endpoint. |
| ASI09Human-Agent Trust Exploitation | Users over-trust the agent — approving a risky action, accepting a recommendation, or rubber-stamping a workflow the agent nudged them toward. | Aligned Human-in-the-loop by design: coach, alert, block, or require a signed justification, set per policy. The override carries a content-free intent log, so a human decision to proceed is recorded as evidence rather than an invisible click — a friction point exactly where blind trust would otherwise pass. |
| ASI10Rogue Agents | A compromised or misbehaving agent acts harmfully while still appearing legitimate. | Direct control Per-agent assurance score, a destination map of what each agent actually reaches, and an entitlement envelope enforced locally at the tool call — plus a cryptographically signed, tamper-evident, content-free decision record, so a rogue agent's behavior is bounded and provable after the fact. |
This is an architecture-level alignment of MoorAI's on-device detectors to the OWASP Top 10 for Agentic Applications (ASI01–ASI10, 2026) — not an OWASP-certified or official mapping. ASI item names are taken from the published OWASP taxonomy and corroborating secondary sources (Promptfoo, Cycode); verify item specifics against the current OWASP resource. Direct control = MoorAI enforces the item on-device; Partial / Aligned / Adjacent = MoorAI covers a slice, with the rest at the identity or orchestration layer; Detect & reconstruct = MoorAI flags and records, but does not itself isolate. Content-free by default — category, risk level, and a keyed one-way hash, never prompt or file content; the one exception is an opt-in capture tier an administrator can turn on explicitly. The agent is open source (AGPL-3.0), so the behavior is auditable. OWASP® is a trademark of the OWASP Foundation.