Most AI-security pages are organised by product feature: a DLP module, an injection filter, an MCP scanner. An attacker thinks in crossings: the places where text, files, tool calls or code move into or out of the agent. So this map is organised the same way: by the boundary the data crosses, the direction it travels, and the adversarial technique that boundary invites.
At the centre sits the AI coding agent — Claude Code, Cursor, Copilot. MoorAI wraps it with a hook on every crossing. It runs on the device, with no cloud in the decision path, through four mechanisms:
- a PreToolUse hook inside the agent;
- an MCP stdio gateway / proxy between the agent and its MCP servers;
- a companion browser extension;
- local-model escalation through Ollama, used opportunistically when it is present.
Underneath all six boundaries sits one 72-threat matrix. The map below is the view of that matrix from the boundary side.
What MITRE ATLAS is
MITRE ATLAS is the open knowledge base of real-world adversarial tactics and techniques against AI systems — ATT&CK, for AI. Each technique has a stable ID, which makes it a shared vocabulary: a security team that already tracks ATT&CK can read an AI control in the same terms. Seven ATLAS techniques appear on this map:
| ATLAS ID | Technique | Where it appears on the map |
|---|---|---|
| AML.T0051 | LLM Prompt Injection | Prompts, files, retrieved input, skills |
| AML.T0057 | LLM Data Leakage | Files / context, AI output |
| AML.T0053 | LLM Plugin Compromise | Tools / actions, skills |
| AML.T0011 | User Execution | Tools / actions, AI output |
| AML.T0020 | Poison Training Data | Retrieved input |
| AML.T0024 | Exfiltration via ML Inference API | Retrieved input |
| AML.T0010 | ML Supply Chain Compromise | Skills |
Inbound — what flows into the agent
Three boundaries only carry data in. This is where the agent’s context is assembled, so this is where injection and leakage start.
| Boundary | Control | ATLAS | What MoorAI does at that boundary |
|---|---|---|---|
| Prompts | Prompt injection | AML.T0051 | Inspects the prompt on the device before the agent acts on it. |
| Jailbreaks (DAN / god-mode) | AML.T0051 | Recognises jailbreak framing in the prompt. | |
| Second-order injection | AML.T0051 | Catches instructions that arrive indirectly and are carried forward into a later turn. | |
| Files / context | Secrets & PII into context | AML.T0057 | Flags secrets and personal data as a file is pulled into the agent’s context. |
| Invisible / obfuscated text | AML.T0051 | Surfaces hidden or obfuscated instructions inside file content. | |
| Cross-context leakage | AML.T0057 | Watches for data from one context bleeding into another. | |
| Input · retrieved | Malicious web / RAG content | AML.T0051 | Inspects retrieved web and RAG content before it becomes context. |
| Knowledge-base poisoning | AML.T0020 | Flags a document headed into a knowledge base or vector index that carries an instruction for the AI that will retrieve it, before it is embedded. | |
| Rogue-endpoint egress | AML.T0024 | Detects the agent being steered toward an unexpected endpoint. |
Both ways — where the agent acts
Two boundaries carry traffic in both directions: the agent sends a request out and receives a result back. Tools and skills are where a compromised instruction turns into a real action.
| Boundary | Control | ATLAS | What MoorAI does at that boundary |
|---|---|---|---|
| Tools / actions | Tool-call & MCP allow-list | AML.T0053 | Decides each tool call and MCP request against policy before it runs. |
| MCP poisoning & rug-pull | AML.T0053 | Watches MCP tool definitions for poisoned descriptions and for a server that changes after it was trusted. | |
| Destructive · lethal trifecta | AML.T0011 | Flags destructive commands and the lethal trifecta (private data, untrusted input and an outbound channel in one agent) and, by policy, coaches, alerts or blocks. | |
| Skills | Skill & rules-file analysis | AML.T0053 | Analyses skills and rules files on the device before the agent loads them. |
| Rules-file poisoning | AML.T0051 | Flags injected instructions inside a CLAUDE.md or equivalent rules file. | |
| Slopsquat / supply chain | AML.T0010 | Flags look-alike and hallucinated package and skill names in the supply chain. |
Outbound — what the agent produces
One boundary only carries data out: the agent’s own output, which a developer is about to accept, run or ship.
| Boundary | Control | ATLAS | What MoorAI does at that boundary |
|---|---|---|---|
| AI output protection | Insecure code & secrets | AML.T0011 | Inspects generated code for insecure patterns and embedded secrets. |
| Dangerous links / scripts | AML.T0011 | Flags links and scripts in the output that a user could be led to run. | |
| System-prompt leakage | AML.T0057 | Detects the agent’s system prompt surfacing in its output. |
Why on the device
Many of these crossings never touch the network. A local file read, a stdio MCP call, a rules file loaded from the repo — none of them generates network egress, so an inline or cloud proxy has nothing to see. The only place those crossings can be governed is the machine they happen on.
So that is where MoorAI decides them. It inspects the content of every crossing (the prompt, the file, the tool arguments, the generated code) on the device, and makes its decision there. It never sends that content anywhere and never stores it. What leaves the machine is only the category, the risk and a keyed one-way hash (plus the login and hostname, which the console pseudonymises on arrival): enough to report and correlate, not enough to reconstruct what was said.
What this map does not claim
ATLAS is much larger than this map
ATLAS covers model theft, training-time attacks, evasion of the model itself and far more. MoorAI governs the agent’s runtime crossings; it does not govern model training or model weights. Seven techniques on this map is seven, not all of ATLAS.
Claude Desktop is partial
On Claude Desktop, MoorAI covers the MCP proxy only. There is no PreToolUse hook there, so the tool-boundary decisions that depend on the hook are not available.
The mapping is our reading
ATLAS and its technique IDs are MITRE’s. Which control maps to which technique is our own reading of that knowledge base. MITRE does not endorse it and has no relationship with MoorAI.
MoorAI maps six boundaries and 18 controls to seven ATLAS techniques. Every crossing is inspected on the device, and only category, risk and a keyed hash (plus the login and hostname, which the console pseudonymises on arrival) ever leave the machine.
MITRE ATLAS is a knowledge base maintained by MITRE — atlas.mitre.org. Technique names and IDs are MITRE’s; the mapping to MoorAI controls is ours. MoorAI is open-source (MIT) runtime guardrails for AI agents, apps and APIs. See also: the live MoorAI threat catalog, rules-file security, and The layer above the model.