Skip to content
MoorAI
02 — attack concepts

Shadow AI

AI tools, agents, models and MCP servers in use without the security team's knowledge or approval: a developer's own coding agent, a chatbot fed company data, a local model server, a personal API key. The risk is less that the tools are bad than that nobody has listed what they can read or reach, so no control and no log covers them.

How MoorAI handles it: moorai-shadow checks the AIBOM inventory against a sanctioned list, and the console raises a finding for an agent in use with no MoorAI hook traffic.

See also AIBOM · runtime AIBOM · shadow AI in coding agents

Related terms

  • AIBOM Defence & response

    An inventory of the AI components in a system or on a device — models and their providers, agents and harnesses, MCP servers, plugins, skills, datasets …

  • Runtime AIBOM Defence & response

    An AIBOM built from what is running and being used, not only from what is installed or declared: which model servers are listening, which MCP servers…

Attack concepts

The mechanisms the families above exploit, plus the agent-specific ones that have no chatbot equivalent. If you only read one entry on this page, read indirect prompt injection.

Shadow AI is term 17 of 17 in this part of the glossary.

Prompt injectionDirect prompt injectionIndirect prompt injectionJailbreakObfuscation / encodingHomoglyphLeetspeakMulti-turn crescendoTool poisoningTool-name shadowingCapability expansionConfused deputyData exfiltrationLethal trifectaLiving off the AIExcessive agencyShadow AI
Get started free Full glossary → How we test → Community agent on GitHub ↗

This page is one entry from the agentic AI security glossary, which defines 82 terms in the same style. Where a term belongs to a published taxonomy or standard — the HackAgent attack families, the OWASP lists, AMTSO's guidelines, MITRE ATLAS, ISO/IEC 42001, the NIST AI RMF, the EU AI Act, W3C Trace Context, the MCP specification — the authoritative wording is the source document's, not ours, and specifics should be verified there. "Lethal trifecta" is Simon Willison's term. OWASP® is a trademark of the OWASP Foundation; ATT&CK® and ATLAS™ are trademarks of The MITRE Corporation. Naming a framework here is description, not a claim of certification or endorsement.