ISO/IEC 27090 names the threats. MoorAI stops them where AI agents act: on the device, before each action runs. The standard is ISO’s guidance on understanding, detecting and mitigating the security threats specific to AI systems, with data poisoning and model theft among its examples, and it is written for every organization that develops or uses AI. That includes every company whose employees run AI agents on their laptops. Here is what a security team gets from MoorAI, family by family.
Where the threat becomes an action
An AI agent turns a prompt into actions: it runs a shell command, reads a file, calls an MCP tool. That is the moment an attack on the agent pays off, and it is exactly where MoorAI sits, inside the agent on the employee’s device.
- Network and SASE tools see traffic. MoorAI sees the action. The command, the file and the tool call, judged on the device, on the VPN or off it.
- Model-API gateways see the prompt. MoorAI sees what follows it. The shell command and the file read the model asked for, checked before they run.
- After-the-fact logging records the incident. MoorAI decides first. On an enrolled device, a signed policy blocks the action or holds it for sign-off.
- Account controls cover the accounts you manage. MoorAI covers the agent. It runs in the agent on the device, whichever account the agent is signed into, and the console flags agents signed in with personal accounts.
Five threat families, stopped on the device
ISO27090-INJECT · Prompt injection, direct and indirect
MoorAI checks everything the agent reads (files, web pages, tool output and MCP results) for direct (rule #2) and indirect (#3) prompt injection, along with every prompt written by an event or a pipeline. Second-order injection (#40) catches a role-spoofing directive planted in data, such as a forged SYSTEM line or a note to the AI that names a tool, at every tool-result stage.
ISO27090-POISON · Data and retrieval poisoning at use time
Knowledge-base and RAG poisoning (#21) and memory poisoning (#22) rules check the content the agent takes in. Scan-before-embed checks content before an application writes it to a vector store, through the SDK, the sidecar and the vector-store tools the MCP gateway recognises, so a poisoned chunk is caught before anyone retrieves it. It reports by default and blocks by policy.
ISO27090-DISCLOSE · Sensitive data and instruction disclosure
On-device DLP checks prompts, file reads, tool arguments and model requests, and masks what it finds. Rules #51 and #52 catch system-prompt extraction attempts and instruction leakage in the model’s output. The console receives a category, a risk and a keyed hash, never the prompt or the file.
ISO27090-AGENCY · Misuse of agent capabilities
Every agent action is checked before it runs: commands, file access, tool calls and MCP calls. Business actions (money, bulk data, identity, destructive, delegation) follow a signed policy that asks or blocks before they run. MCP servers pass an approval gate, and egress rules apply per binary, host and path.
ISO27090-SUPPLY · AI supply chain (models, tools, extensions)
MoorAI checks an MCP server from its registry metadata and manifests before install, without downloading or running it, and gates skills and agent files before install. In drift-block mode, a call to an MCP tool whose definition changed or vanished since approval is refused, judged against a fresh listing. The runtime AIBOM shows which agents, models, MCP servers and editor AI extensions are configured and in use.
The runtime side is where agents act
Model theft and training-time evasion are handled where the model is hosted and built: access control, rate limits and query monitoring on the model’s API, and training-data provenance and robustness testing in the build. The console reports them as ISO27090-EXTRACT and ISO27090-EVASION, owned by the model host and builder. MoorAI covers the runtime side: the agents your employees run every day, and every action they take.
The evidence you hand over
The console reports each family under its own id and builds an ISO/IEC 27090 evidence pack for any audit window up to 366 days: the signed policy versions devices enforced, device coverage and fail mode, alerts by rule and decision, and gaps in each device’s alert numbering, every record content-free. A signed SHA-256 manifest seals the bundle, and your auditor checks it offline with OpenSSL and your tenant’s public key, with no access to your console.
Questions to ask any vendor
- Does it decide before the agent’s command runs, or log it after?
- Does it see the shell command and the file read, not just the prompt?
- Does it check what the agent reads (files, web pages, tool results) for planted instructions?
- When an MCP tool’s definition changes after approval, is the call refused?
- Does it cover an agent signed into a personal account?
- What leaves the device: your prompts and files, or a content-free verdict?
- Can an auditor verify the evidence offline, without your console?
MoorAI answers yes to each, with the evidence to show it.
Everything the agent reads, and every prompt from an event or a pipeline, is scanned for injection by default; promptScan: "all" adds the prompts people type. Poisoning rules catch planted instructions, and the console reports POISON and SUPPLY as partial: provenance-based knowledge-base checks, which catch a forged fact that carries no instruction, and model-file scanning are not part of this release. Outside Windows MXC containment, MoorAI governs the agent’s actions rather than sandboxing it. Device records reach the console authenticated by the tenant install token, and the pack’s signature seals the bundle as a whole.
Sources
- ISO/IEC 27090. ISO/IEC 27090 in the Standards Council of Canada catalogue, for the title and scope.
- MoorAI. The compliance crosswalk’s ISO/IEC 27090 section, with the console ids and evidence per family, and the evidence pack, with how it is sealed.
ISO/IEC 27090 is published by ISO. MoorAI maps its controls to the standard’s threat families; MoorAI is not certified against it.
See also: AEGIS for AI agents on the device, the compliance crosswalk and MCP security.