Skip to content
MoorAI
// blog · threat mapping

Every boundary an AI coding agent crosses — mapped to MITRE ATLAS

An AI coding agent is only as dangerous as what crosses into it and what it sends back out. This is the map of every one of those crossings — prompts, files, retrieved input, tools, skills and output — with each MoorAI control tied to a technique in MITRE ATLAS.

MoorAI boundary map: prompts, files and retrieved input flow into an AI coding agent wrapped by MoorAI on the device; tools and skills flow both ways and AI output flows out; each control is tagged with its MITRE ATLAS technique, and nothing leaves the machine.
MoorAI boundary map · MITRE ATLAS technique IDs · on the device
6 boundaries governed prompt · file · input · tool · output · skill
18 controls on the map three per boundary
7 MITRE ATLAS techniques AML.T0010 through AML.T0057
0 prompts leave the device only category · risk · keyed hash
The diagram above maps every boundary. ATLAS is MITRE’s; the mapping is ours.

Most AI-security pages are organised by product feature: a DLP module, an injection filter, an MCP scanner. An attacker thinks in crossings: the places where text, files, tool calls or code move into or out of the agent. So this map is organised the same way: by the boundary the data crosses, the direction it travels, and the adversarial technique that boundary invites.

At the centre sits the AI coding agent — Claude Code, Cursor, Copilot. MoorAI wraps it with a hook on every crossing. It runs on the device, with no cloud in the decision path, through four mechanisms:

Underneath all six boundaries sits one 67-threat matrix. The map below is the view of that matrix from the boundary side.

What MITRE ATLAS is

MITRE ATLAS is the open knowledge base of real-world adversarial tactics and techniques against AI systems — ATT&CK, for AI. Each technique has a stable ID, which makes it a shared vocabulary: a security team that already tracks ATT&CK can read an AI control in the same terms. Seven ATLAS techniques appear on this map:

ATLAS IDTechniqueWhere it appears on the map
AML.T0051LLM Prompt InjectionPrompts, files, retrieved input, skills
AML.T0057LLM Data LeakageFiles / context, AI output
AML.T0053LLM Plugin CompromiseTools / actions, skills
AML.T0011User ExecutionTools / actions, AI output
AML.T0020Poison Training DataRetrieved input
AML.T0024Exfiltration via ML Inference APIRetrieved input
AML.T0010ML Supply Chain CompromiseSkills

Inbound — what flows into the agent

Three boundaries only carry data in. This is where the agent’s context is assembled, so this is where injection and leakage start.

BoundaryControlATLASWhat MoorAI does at that boundary
PromptsPrompt injectionAML.T0051Inspects the prompt on the device before the agent acts on it.
Jailbreaks (DAN / god-mode)AML.T0051Recognises jailbreak framing in the prompt.
Second-order injectionAML.T0051Catches instructions that arrive indirectly and are carried forward into a later turn.
Files / contextSecrets & PII into contextAML.T0057Flags secrets and personal data as a file is pulled into the agent’s context.
Invisible / obfuscated textAML.T0051Surfaces hidden or obfuscated instructions inside file content.
Cross-context leakageAML.T0057Watches for data from one context bleeding into another.
Input · retrievedMalicious web / RAG contentAML.T0051Inspects retrieved web and RAG content before it becomes context.
Memory & index poisoningAML.T0020Flags poisoned entries in the agent’s memory or retrieval index.
Rogue-endpoint egressAML.T0024Detects the agent being steered toward an unexpected endpoint.

Both ways — where the agent acts

Two boundaries carry traffic in both directions: the agent sends a request out and receives a result back. Tools and skills are where a compromised instruction turns into a real action.

BoundaryControlATLASWhat MoorAI does at that boundary
Tools / actionsTool-call & MCP allow-listAML.T0053Decides each tool call and MCP request against policy before it runs.
MCP poisoning & rug-pullAML.T0053Watches MCP tool definitions for poisoned descriptions and for a server that changes after it was trusted.
Destructive · lethal trifectaAML.T0011Flags destructive commands and the lethal trifecta (private data, untrusted input and an outbound channel in one agent) and, by policy, coaches, alerts or blocks.
SkillsSkill & rules-file analysisAML.T0053Analyses skills and rules files on the device before the agent loads them.
Rules-file poisoningAML.T0051Flags injected instructions inside a CLAUDE.md or equivalent rules file.
Slopsquat / supply chainAML.T0010Flags look-alike and hallucinated package and skill names in the supply chain.

Outbound — what the agent produces

One boundary only carries data out: the agent’s own output, which a developer is about to accept, run or ship.

BoundaryControlATLASWhat MoorAI does at that boundary
AI output protectionInsecure code & secretsAML.T0011Inspects generated code for insecure patterns and embedded secrets.
Dangerous links / scriptsAML.T0011Flags links and scripts in the output that a user could be led to run.
System-prompt leakageAML.T0057Detects the agent’s system prompt surfacing in its output.

Why on the device

Many of these crossings never touch the network. A local file read, a stdio MCP call, a rules file loaded from the repo — none of them generates network egress, so an inline or cloud proxy has nothing to see. The only place those crossings can be governed is the machine they happen on.

So that is where MoorAI decides them. It inspects the content of every crossing (the prompt, the file, the tool arguments, the generated code) on the device, and makes its decision there. It never sends that content anywhere and never stores it. What leaves the machine is only the category, the risk and a keyed one-way hash: enough to report and correlate, not enough to reconstruct what was said.

What this map does not claim

ATLAS is much larger than this map

ATLAS covers model theft, training-time attacks, evasion of the model itself and far more. MoorAI governs the agent’s runtime crossings; it does not govern model training or model weights. Seven techniques on this map is seven, not all of ATLAS.

Claude Desktop is partial

On Claude Desktop, MoorAI covers the MCP proxy only. There is no PreToolUse hook there, so the tool-boundary decisions that depend on the hook are not available.

The mapping is our reading

ATLAS and its technique IDs are MITRE’s. Which control maps to which technique is our own reading of that knowledge base. MITRE does not endorse it and has no relationship with MoorAI.

the one-line summary

MoorAI maps six boundaries and 18 controls to seven ATLAS techniques. Every crossing is inspected on the device, and only category, risk and a keyed hash ever leave the machine.


MITRE ATLAS is a knowledge base maintained by MITRE — atlas.mitre.org. Technique names and IDs are MITRE’s; the mapping to MoorAI controls is ours. MoorAI is open-source (MIT) security for AI coding agents, running on the developer’s machine. See also: the live MoorAI threat catalog, rules-file security, and The layer above the model.

Every crossing, decided on the machine.
MoorAI wraps Claude Code, Cursor and Copilot, inspects every boundary on the device, and maps each control to MITRE ATLAS.
See MoorAI → Read the threat catalog