What each risk is — and how MoorAI covers it, on-device and content-free. Honest by design: where MoorAI is deep we say so, and where an item belongs to the model or gateway layer we say that too. MoorAI focuses on AI agents (Claude Code, Codex, Copilot) and keeps prompt content on the machine.
| Risk | What it is | MoorAI coverage |
|---|---|---|
| LLM01Prompt Injection | Crafted input overrides the model's instructions — directly ("ignore previous instructions…") or indirectly, via instructions hidden in content the agent later reads. | Multilingual injection detection (~29 languages) on prompts, plus second-order / indirect-injection detection in files read into context, RAG payloads, and OCR'd images. |
| LLM02Sensitive Information Disclosure | Secrets, PII, or proprietary source leaking into a prompt, into an agent's context, or back out in a response. | The DLP core — ~14 provider secret families plus PII and source detection across prompts, context reads, MCP tool-call arguments, and outputs, with a content-free exposure ledger for targeted incident-response rotation. |
| LLM03Supply Chain | Compromised or unvetted models, MCP servers, plugins, editor extensions, or datasets entering the agent stack. | On-device AIBOM inventories models and MCP servers with capability-scope risk (network / filesystem / credential); unapproved, risky, and high-risk MCP servers are flagged, alongside editor AI-extension and skill provenance. |
| LLM04Data & Model Poisoning | Poisoned training data or corrupted model / agent memory that biases future behavior. | Detects memory-poisoning attempts on the device. Training-data and model poisoning are largely a pipeline / model-provider concern outside the endpoint's view — assessed honestly, not overclaimed. |
| LLM05Improper Output Handling | Unsafe or unsanitized model output — echoed secrets, injected code, curl | bash, unverifiable citations — consumed downstream without checks. |
Output-stage review with secret-span redaction — MoorAI checks what the agent says back, not just what's typed, and masks flagged spans on the reply path. |
| LLM06Excessive Agency | The agent can do more than it should — over-broad tool access, unapproved servers, actions taken without bounds. | Agency Enforcement: an approved-MCP allow-list enforced at call time (non-allow-listed servers blocked) plus tool-call argument inspection. One of MoorAI's deepest areas — the direct control for LLM06. |
| LLM07System Prompt Leakage | The system / developer prompt — which may hold rules, config, or secrets — is extracted by a probe or recited back in the model's output. | Extraction-probe detection on prompts ("repeat the words above", "print your system prompt") plus system-prompt / instruction-echo detection on outputs. |
| LLM08Vector & Embedding Weaknesses | RAG poisoning, indirect injection embedded in retrieved content, and embedding manipulation that steers the model. | On-device RAG / index inspection — hidden-instruction and invisible-text (zero-width and bidirectional / Trojan-Source characters) detection in retrieved content. Embedding inversion and cross-tenant vector leakage are model-layer concerns, out of the endpoint's scope. |
| LLM09Misinformation | Hallucinated, unreliable, or manipulated output — and over-reliance on it without verification. | Reliability and advisory detectors plus second-order / hidden-instruction rules, coaching users on unverified or unsafe claims at the point of use. |
| LLM10Unbounded Consumption | Resource and cost blowups — token-drain loops, oversized inputs, wallet exhaustion, denial of wallet, or model-extraction by mass querying. | Oversized-input detection, a content-free usage / cost signal (call volume + rough spend), and machine-speed burst / loop detection via the autonomous-agent-behavior signature. Hard rate-limits and budget caps require sitting in the traffic path (a gateway) — MoorAI detects and flags runaway consumption, it doesn't cap it. |
Coverage reflects MoorAI's on-device detectors and the console posture scorecard, mapped to the OWASP LLM Top 10 (2025). Content-free by construction — category, risk level, and a one-way hash, never prompt or file content. This supports your governance and audit work; it is not a certification. OWASP® is a trademark of the OWASP Foundation.