# MoorAI > Security for the AI agents inside your company. MoorAI decides every agent action on the device before it runs, on laptops and AI servers. Trust no AI. MoorAI's slogan is Trust no AI: the guard and the record sit outside the agent. MoorAI checks what an AI agent reads, runs and sends before it acts: coding agents (Claude Code, Codex, Copilot CLI, Cursor, Gemini CLI) through their hooks, Agent SDK services in process, any agent framework through a localhost sidecar, remote MCP servers through an MCP gateway, and model API calls through a model proxy. The agent is open source under the MIT license: https://github.com/gitayg/moorai This file lists all 244 pages in https://moorai.dev/sitemap.xml, each once, including 54 head-to-head comparison pages. Each link's note is that page's own summary. The full body text of the product and compliance pages is at https://moorai.dev/llms-full.txt. New posts are published to an Atom feed at https://moorai.dev/blog/feed.xml. Key facts: - Position: MoorAI is security for the AI agents inside a company: coding agents and desktop AI on endpoints (MoorAI for Agents) and production agents on AI servers (MoorAI for AI Servers), governed from the MoorAI Management Server. Every tool call, file read, command and MCP call an agent makes is decided on the device or server before it runs. In the a16z CISO Survey, October 2026 (N=100, 1,000+ employee organizations), internal AI agent security gained 28 points as a top-five CISO initiative for 2027, the biggest gain of any initiative; the figures are changes in share, not a ranking, so it is the fastest-rising priority, not the top one. - Where MoorAI fits that list: core, what it is built for: internal AI agent security, AI usage and governance, AI-native endpoint prevention. Supports, where a shipped part of MoorAI serves the initiative but MoorAI is not a product in that category: AI SOC, through content-free, ATT&CK- and ATLAS-mapped alerts to the SIEM, and spans over OpenTelemetry (OTLP) from the agent, each with verdict provenance (MoorAI is not an AI SOC product); AI code security, by securing the coding agents that write the code against rules-file and instruction poisoning, secret and source exfiltration, risky package installs and unscanned model files (MoorAI is not a code scanner or SAST); AI GRC and vendor risk, through framework crosswalks to the OWASP LLM and Agentic Top 10, the EU AI Act, AIUC-1, MITRE ATLAS and ATT&CK, mapped, not certified, and MCP server reputation scoring for third-party AI components. Not claimed: AI offensive security and AI vulnerability remediation. Budget is moving from EDR/XDR, SIEM, PAM and exposure management toward AI; MoorAI complements EDR (EDR sees processes, MoorAI decides each action the agent takes) and feeds the SIEM a team already runs, and replaces neither. - Proof: 93 threat rules in 17 categories; 35 of the 76 MITRE ATLAS agentic techniques (20 of them bounded), more than any of the 53 vendors in the ATLAS coverage study (https://moorai.dev/moorai-atlas-coverage.html); on the open Agentic Security Benchmark, 77.9% attack recall and a 4.9% false-positive rate over 1,177 samples (MoorAI v1.47.0, https://moorai.dev/benchmark.html). - Products: MoorAI comes as three products. MoorAI for Agents (free forever, open source under MIT): the standalone agent for macOS, Windows and Linux that checks every AI agent action on the device before it runs, with hooks for Claude Code, Codex, Cursor, Copilot CLI, Gemini CLI and Factory Droid, an MCP guard, Browser Guard, static model-file scanning and local policy; with no account it coaches. https://moorai.dev/moorai-for-endpoints.html. MoorAI Management Server (self-hosted: free, no user limit; hosted by MoorAI: contact us): the console that turns endpoints into a governed fleet with signed policy, enforcement (block, require sign-off, end the session), per-tool MCP approval, alerts, SIEM export, a signed evidence pack and multiple tenants, hosted at app.moorai.dev or as a private deployment in your own environment. https://moorai.dev/console.html. MoorAI for AI Servers (priced per server, contact us): for AI factories, a sidecar container next to model servers and agent services with the MCP gateway, the model proxy, the Agent SDK and server mode, and knowledge-base and RAG checks, checking model calls, MCP tool calls and agent actions on the server with content-free records to the Management Server. https://moorai.dev/for-ai-apps.html. Prices: https://moorai.dev/pricing.html - Local models: MoorAI secures the models a company runs itself (Ollama, LM Studio, llama.cpp, vLLM). A daily posture scan finds local model servers that any local process can reach, or that are bound beyond loopback, and raises a content-free alert (LOCAL_MODEL_EXPOSED). Administrators pin approved model files by sha256, and an agent loading an unpinned model is reported, held for sign-off or denied. The model proxy has a loopback-only /ollama route that checks what an agent sends to a local Ollama and what comes back. An optional second opinion on ambiguous scans uses a local Ollama model on 127.0.0.1, so the text never leaves the machine. Overview: https://moorai.dev/#local-models - What it is: a hook the coding agent passes through before each tool call runs, plus scanning of what comes back. It checks file reads (including .env by path), shell commands, file writes and edits, web fetches, MCP tool calls and their arguments, and sub-agent prompts, on the developer's machine. On Claude Code it also scans command output, MCP responses, sub-agent reports and fetched pages after the tool runs. - Agents: Claude Code, where enforcement is validated end to end. Codex CLI, GitHub Copilot CLI, Gemini CLI and Cursor run the same engine through their own pre-tool hooks; those adapters are tested against each vendor's documented hook payloads and not yet against the live agents. A stdio MCP proxy covers MCP traffic in other hosts such as Claude Desktop. - Actions: coach, alert, mask (replace a secret or personal-data span with a content-free placeholder and let the call proceed), block, require a signed justification, or end the agent session, per policy. A device that is not enrolled in a console coaches only: it shows what it caught and the safer way, blocks nothing and posts nothing. - Data handling: content is checked on the device. An enrolled device sends the console a category, a risk level and a keyed one-way hash (plus the login and hostname, which the console pseudonymises on arrival), never the prompt, the file or the matched text. - Install: curl -fsSL https://raw.githubusercontent.com/gitayg/moorai/main/scripts/install.sh | sh registers the Claude Code hooks (needs git and Node 18+, no account); node ~/.moorai/cli/moorai-agent-hook.mjs codex install (or copilot, gemini, cursor) adds another agent; node ~/.moorai/cli/moorai-doctor.mjs checks the install. Desktop apps: macOS (Apple silicon) and Windows. Linux: a .deb or tarball for amd64 and arm64 on each GitHub release, checked with sha256sum -c SHA256SUMS, installed with sudo dpkg -i or the tarball's install.sh (needs Node.js 18+). Steps: https://moorai.dev/quick-start.html - Evidence: every agent session is one W3C trace, with traceId, spanId and parentSpanId on every alert and allow-trail record; the model proxy and the MCP stdio guard send a traceparent on. On Claude Code a per-session context tree (an RFC 6962 Merkle tree of content-free leaves for each prompt, file read, web result, MCP result, command output and sub-agent hand-off) puts its root on every record, an injection alert names the leaf behind it, and moorai-context-proof --verify --all lists every session on the device that took in a file. Details: https://moorai.dev/capabilities.html - Console views: a runtime AIBOM of which agent used which model, MCP server and tool (a value no source measures is shown as not measured, never zero), granted vs used per agent and device with a previewed apply-as-policy that never widens a list, agent ownership, a trace view per session and a context tab that re-verifies each record's root. https://moorai.dev/console.html - Frameworks: rules are tagged with the OWASP LLM Top 10, MITRE ATLAS, the OWASP Agentic and MCP Top 10s and MITRE ATT&CK Enterprise v20 (in agent v1.47.0, 51 of 93 rules map to 68 ATT&CK techniques and the other 42 state why they have none; of the 71 v20 techniques an AI agent can perform or be aimed at, 8 are covered, 52 partial (13 bounded by design, 39 open gap) and 11 uncovered). Technique by technique: https://moorai.dev/moorai-attack-coverage.html - Price and licence: MoorAI for Agents is free and open source under MIT. The MoorAI Management Server is source-available under the Elastic License 2.0: free self-hosted, with no user limit; hosted by MoorAI, it is paid (contact us). MoorAI for AI Servers is priced per server; its components ship in the MIT agent. - Limits: MoorAI is governance, not a sandbox. By default it fails open if its hook crashes or times out (an administrator can set each surface to fail closed in the signed policy or the root-owned machine config), and it runs as the same user as the agent. The context tree is tamper-evident, not tamper-proof (it lives in the user's home), files a host loads without a tool call get no leaf, the HTTP MCP gateway starts its own trace unless the client sends one, and trace ids and leaves reach the console with the install token, not device-signed. In the console, unused means no call recorded while measured, and departed owners are not detected (no directory sync). ## Product - [MoorAI: AI agent security for endpoints and AI servers](https://moorai.dev/): Security for the AI agents inside your company. MoorAI decides every agent action on the device before it runs, on laptops and AI servers. Trust no AI. - [Quick start: install MoorAI and guard Claude Code](https://moorai.dev/quick-start.html): Install MoorAI on macOS, Windows or Linux: one command adds its Claude Code hooks, another adds Codex, Copilot CLI, Gemini CLI or Cursor. Then enroll. - [About MoorAI](https://moorai.dev/about.html): Open-source (MIT) runtime guardrails for AI agents, apps and APIs. Checks run where the agent runs; an optional console receives content-free signals. - [AI agents in digital forensics and incident response](https://moorai.dev/ai-in-digital-forensics.html): For DFIR teams using AI agents on case data: partial checks labelled, every alert's basis shown, evidence paths guarded and a tamper-evident action record. - [Capabilities: prompts, files and MCP calls, on-device](https://moorai.dev/capabilities.html): What MoorAI checks on the device against a 93-threat matrix: prompts, downloaded files, skills, memory writes, MCP calls, model files and tool-call targets. - [Claude Code security: block .env reads and secret leaks](https://moorai.dev/claude-code-security.html): How to stop Claude Code reading .env, leaking secrets or obeying injected text: native deny rules plus an on-device PreToolUse hook. Open source (MIT). - [MoorAI Management Server: govern every AI agent on the fleet](https://moorai.dev/console.html): MoorAI Management Server: AI usage and governance for every agent. Signed policy, enforcement, MCP approval, AIBOM, SIEM export. Free to self-host. - [Contact](https://moorai.dev/contact.html): Contact MoorAI — questions about MoorAI, pricing, or a deployment. - [Content-free data lineage for AI agents](https://moorai.dev/content-free-data-lineage.html): Content-free data lineage for AI agents: a Source → Actor → Destination event-flow graph built from redacted signals. No filenames or prompt content. - [Download MoorAI for macOS, Windows and Linux](https://moorai.dev/download.html): Download the MoorAI agent: a signed, notarized macOS app for Apple silicon or a Homebrew cask, the Windows x64 installer, or a Linux .deb or tarball. - [MoorAI for Agents: tech specs](https://moorai.dev/endpoint-specs.html): What MoorAI for Agents, the free agent, checks on each device, from downloaded files to model hashes and MCP calls, what runs where and what is tested. - [FAQ: EU AI Act, data handling and supported agents](https://moorai.dev/faq.html): Answers on MoorAI: EU AI Act readiness, what security teams see, which AI agents it works with, whether prompts leave the device, and open source. - [MoorAI for AI Servers: AI agent runtime security](https://moorai.dev/for-ai-apps.html): AI agent runtime security for the production agents you run: a sidecar, model proxy, MCP gateway and egress proxy check each call before the agent acts. - [For developers using AI coding agents](https://moorai.dev/for-ai-coding-agents.html): Hooks that check each shell command, file read and MCP call in Claude Code, Codex, Copilot CLI, Gemini CLI and Cursor, plus a context tree for forensics. - [How MoorAI works: one check where the AI acts](https://moorai.dev/how-it-works.html): How MoorAI works: one check before each prompt and tool call reaches the AI, then content-free signals, never the prompt, to the console. - [Log in](https://moorai.dev/login.html): Log in to your MoorAI console. Enter your email and we'll send a one-time login link — no password to remember, nothing to install. - [MoorAI Management Server: tech specs](https://moorai.dev/management-server-specs.html): What the MoorAI Management Server sets and shows: policy, presets, fail mode, runtime AIBOM, trace view, ownership and context evidence. - [How to secure MCP servers for coding agents](https://moorai.dev/mcp-security.html): Secure the MCP servers coding agents use: approve before use, scan tool arguments and results, catch tool poisoning and rug pulls, vet the package first. - [MoorAI for Agents: free AI agent security for every device](https://moorai.dev/moorai-for-endpoints.html): MoorAI for Agents: free, open-source (MIT) security for Claude Code, Cursor, Codex and desktop AI. Every agent action is checked on the device before it runs. - [Sample AI-Readiness Report](https://moorai.dev/moorai-sample-report.html): A sample MoorAI AI-readiness report: composite trust score, category breakdown, framework control-mapping, and content-free data-lineage-by-agent. Example data. - [On-device AI DLP: secrets and PII in coding agents](https://moorai.dev/on-device-ai-dlp.html): On-device AI DLP for coding agents: MoorAI masks or blocks secrets, PII and source code in prompts, file reads and tool calls before they reach the agent. - [Partners: resell, run and integrate AI agent security](https://moorai.dev/partners.html): Resellers, MSSPs, distributors, integrators and technology partners: bring MoorAI's security for the AI agents inside the company to your customers. - [AI agent permission right-sizer](https://moorai.dev/tools/permission-right-sizer.html): Paste a Claude Code, Codex, Gemini CLI, Cursor or MCP config and see what your AI agent may do, what is risky, and a tighter version. Runs in your browser. - [MoorAI pricing: Agents, Management Server, AI Servers](https://moorai.dev/pricing.html): MoorAI for Agents is free and open source (MIT). Management Server: free self-hosted; hosted by MoorAI, contact us. MoorAI for AI Servers is priced per server. - [AI agent security for regulated and defense teams](https://moorai.dev/regulated-and-defense.html): Self-host the MoorAI console in your own environment, keep content on the device, set fail closed by policy, and map evidence to ISO/IEC 42001 and 27090. - [AI rules-file security: detect a poisoned CLAUDE.md](https://moorai.dev/rules-file-security.html): Poisoned rules files and skills (CLAUDE.md, SKILL.md) steer every prompt. MoorAI flags hidden instructions, agent writes and drift on-device, content-free. - [MoorAI for AI Servers: tech specs](https://moorai.dev/runtime-protection-specs.html): Each component of MoorAI for AI Servers: Agent SDK hooks, sidecar, model proxy, task-bound tool calls, model pinning, file scanning, MCP gateway and RAG checks. - [Security for AI: five categories and MoorAI's coverage](https://moorai.dev/security-for-ai.html): Security for AI secures the agents themselves: runtime, accountability, governance, access and identity. MoorAI's coverage of each, gaps included. - [Shadow-agent discovery for developer laptops](https://moorai.dev/shadow-agent-discovery.html): Find unmanaged AI coding agents on your developer endpoints. MoorAI builds a content-free AI-agent inventory on-device; content stays on the machine. - [Shadow-AI detection for coding agents](https://moorai.dev/shadow-ai-detection-for-coding-agents.html): Shadow-AI detection for coding agents: inventory personal accounts, unmanaged apps and CLIs, MCP servers and browser extensions from content-free signals. - [Explore MoorAI — site directory](https://moorai.dev/site-directory.html): Explore MoorAI products, security references, technical evidence, practical guides and research articles in one searchable directory. - [What MoorAI catches: example prompts by threat category](https://moorai.dev/threat-examples.html): Example prompts MoorAI recognizes, by threat category: secrets, injection, exfiltration, hidden skill instructions, downloaded files and backdoored models. - [MoorAI Trust — content-free AI security you can verify](https://moorai.dev/trust.html): Every MoorAI AI-risk check runs on-device against keyed one-way hashes; content leaves only if an admin enables a capture tier. Open source (MIT), verifiable. - [Who it's for: employees and developers](https://moorai.dev/who-its-for.html): One MoorAI agent, two kinds of user: employees and developers. The checking happens locally; content stays on the machine. - [Workflow: five layers and three moves on every prompt](https://moorai.dev/workflow.html): How MoorAI works: five defense layers on the device, then review, coach, alert or block, and central visibility built from redacted metadata only. ## Comparisons - [MITRE ATLAS agentic-technique coverage by vendor](https://moorai.dev/moorai-atlas-coverage.html): 53 AI-security vendors read against the 76 MITRE ATLAS agentic techniques. 27 are documented by none of them, nor by a MoorAI rule; 10 are defence-side. - [MITRE ATLAS: model providers vs MoorAI](https://moorai.dev/moorai-atlas-model-providers.html): Model providers' own safety docs read against the 76 MITRE ATLAS agentic techniques, every cell with a URL, a quote and a limit, and MoorAI beside them. - [MoorAI vs the field — on-device AI agent security](https://moorai.dev/moorai-comparison.html): One page comparing MoorAI's content-free, on-device AI-agent security against 36 vendors — 41 capabilities, mapped honestly. Open source (MIT). - [MoorAI vs Above Security — insider risk vs agent runtime](https://moorai.dev/moorai-vs-above.html): MoorAI vs Above Security: an insider-risk investigation platform that reads AI activity after the fact vs a hook that decides before a coding agent acts. - [MoorAI vs AIR — on-device guardrail vs context firewall](https://moorai.dev/moorai-vs-air.html): MoorAI vs AIR: content-free runtime guardrails for AI agents, apps and APIs vs a context firewall for endpoint, SaaS and cloud agents. - [MoorAI vs Akto — endpoint AI platform vs content-free hook](https://moorai.dev/moorai-vs-akto.html): MoorAI vs Akto: both hook Claude Code, Cursor and other coding agents. Akto reports prompts to its dashboard; MoorAI decides on the device, content-free. - [MoorAI vs Backslash: agent hook vs MCP proxy](https://moorai.dev/moorai-vs-backslash.html): MoorAI vs Backslash: a content-free PreToolUse hook with no proxy vs an MCP proxy on the workstation that reads prompt and tool-call content. - [MoorAI vs Bay Security — two on-device enforcers, compared](https://moorai.dev/moorai-vs-bay.html): MoorAI vs Bay Security: both decide AI agent actions on the device, before they run. Bay generates the policy; MoorAI also reads each action's content. - [MoorAI vs Bifrost Edge — on-device vs gateway-routed](https://moorai.dev/moorai-vs-bifrost.html): MoorAI vs Bifrost Edge: both endpoint agents for shadow AI. Bifrost Edge routes AI traffic through its gateway; MoorAI inspects on the device, content-free. - [MoorAI vs BigID: agent governance vs data-at-rest security](https://moorai.dev/moorai-vs-bigid.html): MoorAI vs BigID: runtime guardrails for AI agents, apps and APIs vs enterprise data-at-rest discovery, classification and DSPM. Different layers, complementary. - [MoorAI vs Bloom Security — endpoint control vs per-action guardrails](https://moorai.dev/moorai-vs-bloom.html): MoorAI vs Bloom Security: Bloom controls what is installed and configured on the endpoint; MoorAI decides each AI agent action by its content before it runs. - [MoorAI vs Cato Networks AI Security — what leaves the device](https://moorai.dev/moorai-vs-cato.html): MoorAI vs Cato Networks: both block coding-agent tool calls before they run. MoorAI sends no content and needs no network; Cato reaches desktop and site AI. - [MoorAI vs Certiv: content-free, open vs a broad intent platform](https://moorai.dev/moorai-vs-certiv.html): MoorAI vs Certiv: both intercept AI-agent actions on the endpoint. Certiv is a broad, content-aware intent platform; MoorAI is content-free and open source. - [MoorAI vs CrowdStrike — cloud AIDR vs on-device decisions](https://moorai.dev/moorai-vs-crowdstrike.html): MoorAI vs CrowdStrike Falcon AIDR: both inspect AI agent prompts and tool calls. CrowdStrike decides in its cloud; MoorAI decides on the device. - [MoorAI vs Cycode: agent governor vs a full ASPM platform](https://moorai.dev/moorai-vs-cycode.html): MoorAI vs Cycode: a full ASPM platform that also secures AI-generated code vs a narrow, open-source (MIT), content-free governor for coding-agent actions. - [MoorAI vs DeepKeep — same hooks, different decision point](https://moorai.dev/moorai-vs-deepkeep.html): MoorAI vs DeepKeep: both hook Cursor and Claude Code. DeepKeep routes each event to its service to decide; MoorAI decides on the device and sends no content. - [MoorAI vs dope.security — agent hook vs on-device SWG](https://moorai.dev/moorai-vs-dope.html): MoorAI vs dope.security: an on-device Secure Web Gateway that inspects SSL egress vs a hook on the agent and MCP tool call, content-free by default. - [MoorAI vs Endor Labs: agent guardrail vs AppSec platform](https://moorai.dev/moorai-vs-endor.html): MoorAI vs Endor Labs: both ride the agent's hooks. Endor streams prompts and actions to its cloud backend; MoorAI is content-free by default and on-device. - [MoorAI vs Enkrypt AI — on-device vs a guardrails service](https://moorai.dev/moorai-vs-enkrypt.html): MoorAI vs Enkrypt AI: both stop risky coding-agent actions. Enkrypt sells guardrails as a service; MoorAI judges content on the device. Gaps included. - [MoorAI vs Ent — focused agent guardrail vs endpoint prevention](https://moorai.dev/moorai-vs-ent.html): MoorAI vs Ent: both act on the endpoint in real time. Ent is broad intent-aware prevention; MoorAI is focused, content-free guardrails for AI agents and APIs. - [MoorAI vs Forcepoint: on-device vs inline data security](https://moorai.dev/moorai-vs-forcepoint.html): MoorAI vs Forcepoint AI Data Security: content-free runtime guardrails for AI agents, apps and APIs vs inline DLP that inspects prompts and responses. - [MoorAI vs Google Cloud and Wiz — agent platform and agent actions](https://moorai.dev/moorai-vs-google-cloud-wiz.html): Google Cloud and Wiz secure the agents you run in the cloud; MoorAI checks what agents do on the device. Who covers what, from Google's and Wiz's own pages. - [MoorAI vs Harmonic Security: coding agents vs GenAI DLP](https://moorai.dev/moorai-vs-harmonic.html): MoorAI vs Harmonic Security: workforce-wide GenAI DLP across AI web tools vs content-free runtime guardrails for AI agents, apps and APIs. - [MoorAI vs HiddenLayer — detection API vs on-device verdict](https://moorai.dev/moorai-vs-hiddenlayer.html): MoorAI vs HiddenLayer: both gate Claude Code and Cursor at the hook. HiddenLayer's hooks call its detection API; MoorAI reaches the verdict on the device. - [MoorAI vs Holistic AI — AI governance vs agent hooks](https://moorai.dev/moorai-vs-holistic.html): MoorAI vs Holistic AI: a governance platform with an SDK and a device agent, or a control inside the coding agent's hooks. Gaps included. - [MoorAI vs Hush Security — agent identity vs action content](https://moorai.dev/moorai-vs-hush.html): MoorAI vs Hush Security: Hush gives each AI agent an identity, an owner and just-in-time credentials; MoorAI decides by what an agent's action contains. - [MoorAI vs Kitecyber: action interception vs decrypting proxy](https://moorai.dev/moorai-vs-kitecyber.html): MoorAI vs Kitecyber: a local decrypting proxy that inspects all device traffic vs interception of the agent's action, the PreToolUse hook and MCP tool call. - [MoorAI vs Lakera — on-device agent guardrails vs a cloud API](https://moorai.dev/moorai-vs-lakera.html): MoorAI vs Lakera Guard: runtime guardrails for AI agents, apps and APIs vs a cloud API that screens deployed LLM apps. Open source (MIT). - [MoorAI vs Lasso Security: same hooks, a different place to decide](https://moorai.dev/moorai-vs-lasso.html): MoorAI vs Lasso Security: both hook Claude Code before a tool runs. Lasso judges content in its service; MoorAI decides on the device. Where Lasso is broader. - [MoorAI vs Miggo Security — application runtime vs agent actions](https://moorai.dev/moorai-vs-miggo.html): MoorAI vs Miggo Security: application detection and response in production vs runtime security for each AI agent action, on servers and endpoints. - [MoorAI vs MIND — data loss prevention vs agent runtime](https://moorai.dev/moorai-vs-mind.html): MoorAI vs MIND: data loss prevention for sensitive data everywhere it lives vs runtime security that decides before an AI agent acts, on endpoints and servers. - [MoorAI vs Netskope — on the device vs in the cloud path](https://moorai.dev/moorai-vs-netskope.html): MoorAI vs Netskope: on-device guardrails for AI agents vs an inline SASE gateway. Content stays on the machine. Same on-device-vs-gateway contrast as Zscaler. - [MoorAI vs NeuralTrust — gateway-first vs on-device](https://moorai.dev/moorai-vs-neuraltrust.html): MoorAI vs NeuralTrust: both hook coding agents. NeuralTrust sends each event to its TrustGuard evaluator; MoorAI decides on the device and sends no content. - [MoorAI vs Noma Security — on-device vs backend evaluation](https://moorai.dev/moorai-vs-noma.html): MoorAI vs Noma Security: Noma's plugin streams coding-agent hook events to its cloud console for evaluation; MoorAI evaluates on-device, content-free. - [MoorAI vs Onyx Security — session capture vs content-free](https://moorai.dev/moorai-vs-onyx.html): MoorAI vs Onyx Security: both stop a coding agent's tool call before it runs. Onyx records the session; MoorAI decides on the device and sends no content. - [MoorAI vs Operant AI — developer endpoint vs cloud runtime](https://moorai.dev/moorai-vs-operant.html): MoorAI vs Operant AI: Kubernetes-native runtime defense for cloud, APIs and hosted AI apps vs content-free runtime guardrails for AI agents, apps and APIs. - [MoorAI vs Pillar Security: two endpoint agents, two records](https://moorai.dev/moorai-vs-pillar.html): MoorAI vs Pillar Security: both run an agent on the developer machine. Pillar logs every prompt and tool call; MoorAI keeps content-free evidence by default. - [MoorAI vs Pluto Security — agent guardrail vs AI builder platform](https://moorai.dev/moorai-vs-pluto.html): MoorAI vs Pluto Security: Pluto finds, scores and governs the AI tools and add-ons people build with. MoorAI decides each agent action on the device. - [MoorAI vs Microsoft Purview — Microsoft 365 data and agent actions](https://moorai.dev/moorai-vs-purview.html): Microsoft Purview governs your Microsoft 365 data; MoorAI governs what AI agents do. Who covers what, from Microsoft's own docs, and why to run both. - [MoorAI vs Rein Security — learned baseline vs action content](https://moorai.dev/moorai-vs-rein.html): MoorAI vs Rein Security: both secure AI agents at runtime. Rein learns a baseline in-process; MoorAI enforces signed policy per action on servers and endpoints. - [MoorAI vs Rig Security — identity scope vs action content](https://moorai.dev/moorai-vs-rig.html): MoorAI vs Rig Security: both stop a coding agent on the device before it acts. Rig decides by identity and resource; MoorAI by what the action contains. - [MoorAI vs Runlayer — on-device guardrail vs control plane](https://moorai.dev/moorai-vs-runlayer.html): MoorAI vs Runlayer: an on-device guardrail and an AI control plane compared. Where content is inspected, what each enforces, and where Runlayer covers more. - [MoorAI vs Salt Code: advisory guidance vs enforcement](https://moorai.dev/moorai-vs-salt-code.html): MoorAI vs Salt Code: a remote MCP server that returns security guidance for the model to read, advisory and fail-open, vs blocking the action before it runs. - [MoorAI vs Salt Security: agent guardrails vs API security](https://moorai.dev/moorai-vs-salt.html): MoorAI vs Salt Security: runtime guardrails for AI agents, apps and APIs vs an API-security platform that protects agents and APIs inline. Complementary. - [MoorAI vs SentinelOne: action interception vs AI firewall](https://moorai.dev/moorai-vs-sentinelone.html): MoorAI vs SentinelOne: content-free runtime guardrails for AI agents, apps and APIs vs a content-inspecting AI firewall (the former Prompt Security). - [MoorAI vs Snyk: agent tool calls vs developer security](https://moorai.dev/moorai-vs-snyk.html): MoorAI vs Snyk: on-device guardrails for coding-agent tool calls vs a developer-security platform (SCA, SAST, container, IaC). Different layers. - [MoorAI vs Socket — the agent's tool calls vs the dependency graph](https://moorai.dev/moorai-vs-socket.html): MoorAI vs Socket: on-device guardrails for coding-agent tool calls vs a software supply-chain firewall for packages. Different layers. - [MoorAI vs Sonatype: agent tool calls vs component supply chain](https://moorai.dev/moorai-vs-sonatype.html): MoorAI vs Sonatype: on-device guardrails for coding-agent tool calls vs a component supply-chain platform (Nexus Repository, Repository Firewall, SBOM). - [MoorAI vs Straiker: same hook point, different detection](https://moorai.dev/moorai-vs-straiker.html): MoorAI vs Straiker: both hook Claude Code. Straiker routes traces to its Detection Cloud; MoorAI decides on the device, online or offline. Open source (MIT). - [MoorAI vs Sun Security — agent purpose vs action content](https://moorai.dev/moorai-vs-sun.html): MoorAI vs Sun Security: both check AI agent actions before they run. Sun holds each agent to a purpose it derives; MoorAI reads each action's content. - [MoorAI vs Sunglasses: action enforcement vs input firewall](https://moorai.dev/moorai-vs-sunglasses.html): MoorAI vs Sunglasses: an open-source input firewall for what goes into an agent vs enforcement across input, output and tool calls, with content-free evidence. - [MoorAI vs Uber ADR — block before, or detect after](https://moorai.dev/moorai-vs-uber-adr.html): MoorAI vs Uber's open-source ADR: MoorAI checks each coding-agent action on the device before it runs; ADR reads agent logs afterwards and investigates. - [MoorAI vs Vero Security — agent lifecycle vs action content](https://moorai.dev/moorai-vs-vero.html): MoorAI vs Vero Security: Vero maps every agent, scans its posture and blocks forbidden actions; MoorAI enforces signed policy on each action, content-free. - [MoorAI vs Virtue AI — guard endpoint vs on-device verdict](https://moorai.dev/moorai-vs-virtue.html): MoorAI vs Virtue AI (Fortinet): both hook Claude Code. Virtue sends each event to its Guard endpoint; MoorAI decides on the device and sends no content. - [MoorAI vs WitnessAI: network governance vs a hook in the agent](https://moorai.dev/moorai-vs-witnessai.html): MoorAI vs WitnessAI: network-level AI governance with no endpoint client vs a hook inside the coding agent that decides on the device, content-free by default. - [MoorAI vs Zenity: on-device DLP vs agent-governance console](https://moorai.dev/moorai-vs-zenity.html): MoorAI vs Zenity: content-free runtime guardrails for AI agents, apps and APIs vs a cross-estate agent-governance console. - [MoorAI vs Zscaler — on the device vs in the network path](https://moorai.dev/moorai-vs-zscaler.html): MoorAI vs Zscaler: runtime guardrails for AI agents, apps and APIs vs an inline Zero Trust Exchange. Content stays on the machine. ## Compliance and frameworks - [AI risk guide: how to mitigate each AI risk](https://moorai.dev/ai-risk-guide.html): The risks of using AI at work, from data leakage and prompt injection to excessive agency and shadow AI, and how to mitigate each manually and with MoorAI. - [EU AI Act Article 4 (AI literacy) explained](https://moorai.dev/eu-ai-act-article-4-ai-literacy.html): EU AI Act Article 4 explained: applied since 2 Feb 2025, enforceable 2 Aug 2026, no direct fine. MoorAI delivers AI literacy at the point of use. - [EU AI Act: timeline, bans and obligations by role](https://moorai.dev/eu-ai-act.html): EU AI Act as amended by the AI Omnibus: every application date, the ten Article 5 prohibited practices, and obligations by role, each tied to the article. - [AIUC-1 explained: where MoorAI's controls fit](https://moorai.dev/moorai-aiuc-1.html): What AIUC-1 is, who publishes it, how its six pillars are structured, and which requirements MoorAI's controls bear on. MoorAI is not AIUC-1 certified. - [AI agent audit evidence: compliance crosswalk](https://moorai.dev/moorai-compliance-crosswalk.html): What your auditor asks about AI agents under SOC 2, ISO 27001, 42001 and 27090, NIST AI RMF, the EU AI Act and Forrester AEGIS, and the MoorAI evidence for it. - [Israel's Responsible-AI Guide: how MoorAI maps](https://moorai.dev/moorai-israel-responsible-ai.html): How MoorAI maps to Israel's Guide for Responsible Use of AI in the Public Sector: governance roles, the four-stage risk process, and what it leaves to you. - [OWASP Agentic Top 10 (ASI01–ASI10) — how MoorAI aligns](https://moorai.dev/owasp-agentic-top-10.html): The OWASP Agentic Top 10 (ASI01–ASI10) explained item by item, and how MoorAI's 93-threat matrix aligns with each one, including the honest gaps. - [OWASP LLM Top 10 control-mapping reports](https://moorai.dev/owasp-llm-top-10-tooling.html): Map AI-coding-agent detections to the OWASP LLM Top 10, MITRE ATLAS and NIST AI RMF — content-free control-mapping reports for your audit, not a certification. - [OWASP LLM Top 10 explained, item by item](https://moorai.dev/owasp-llm-top-10.html): The OWASP LLM Top 10 (2025) explained item by item — LLM01–LLM10 — with how MoorAI covers each one on-device and content-free, including the honest gaps. ## Research and benchmark - [Attack families — what a product adds over model refusal](https://moorai.dev/attack-families.html): Every attack family, scored on what a security product catches over what the Claude Sonnet assistant already refuses unaided, measured per AMTSO v1.0. - [Agentic Security Benchmark: open corpus and harness](https://moorai.dev/benchmark.html): An Apache-2.0 corpus of 299 attack and 878 benign samples plus a zero-dependency harness, for measuring what an agentic-AI security product actually stops. - [Security advisories and disclosure policy](https://moorai.dev/disclosures.html): Security advisories for our own products, each with a permanent URL, the fixing commit, severity reasoning and a timeline. Vendor-assigned IDs, no CVEs. - [Agentic security benchmark leaderboard](https://moorai.dev/leaderboard.html): A public leaderboard for agentic security products, scored against AMTSO's testing guidelines v1.0. Every figure is read from the open benchmark repository. - [MITRE ATT&CK v20 coverage, technique by technique](https://moorai.dev/moorai-attack-coverage.html): Every MoorAI rule mapped to MITRE ATT&CK Enterprise v20: each technique's coverage level and reason, the agent lane, and what sits outside it. - [SAF-MCP, CSA ATF and Careful Adoption crosswalks](https://moorai.dev/moorai-framework-crosswalks.html): SAF-MCP, Careful adoption of agentic AI services and the CSA Agentic Trust Framework, item by item against MoorAI: status, evidence, and the limit or gap. - [AI agent threat rule-base: OWASP, ATLAS, ATT&CK, STRIDE](https://moorai.dev/moorai-threat-catalog.html): MoorAI's AI-agent threat rule-base: every threat it detects, mapped to the OWASP LLM, Agentic and MCP Top 10s, MITRE ATLAS, ATT&CK v20 and STRIDE. - [How we test: taxonomies, harnesses and limits](https://moorai.dev/testing-methodology.html): The method behind MoorAI's detection numbers: the taxonomy, AMTSO's agentic testing guidelines, corpus labelling, the locked tune/test split and the limits. ## Blog - [AI Bill of Materials (AIBOM) and the EU AI Act](https://moorai.dev/blog/ai-bill-of-materials-eu-ai-act.html): A content-free AI Bill of Materials (AIBOM) for the EU AI Act: models, agents and MCP servers inventoried on the device from config metadata, never prompts. - [MoorAI blog: AI governance, evidence and supply chain security](https://moorai.dev/blog/): Writing from MoorAI on AI governance, evidence and software supply chain security. - [The 5 questions every AI-governance buyer is being asked](https://moorai.dev/blog/five-questions-ai-governance.html): The five questions every AI-governance buyer is now being asked, from shadow-agent discovery to tamper-evident evidence, and MoorAI's content-free answers. - [ISO/IEC 42001: content-free AIMS evidence](https://moorai.dev/blog/moorai-iso-42001.html): How MoorAI's shipped controls map to ISO/IEC 42001 (Clause 5.4, Clause 8, Annex A) as content-free, on-device evidence for an AI Management System. - [Reading the 2026 SANS AI Survey: the audit gap](https://moorai.dev/blog/moorai-sans-2026.html): The 2026 SANS AI Survey: 76% of security teams own AI governance, 63% have no visibility into AI use, and 54% say no AI audit frameworks exist. - [What's new in MoorAI, v1.17 to v1.46: MCP, secrets and oversight](https://moorai.dev/blog/whats-new-in-moorai-v1-17-to-v1-46.html): MoorAI agent v1.17 to v1.46: more agents, MCP checks, encoded-secret egress, oversight and task-bound tool calls, model scanning. Each with its limit. - [A sandbox can't judge what your AI agent does](https://moorai.dev/blog/ai-agents-in-sandboxes.html): CISOs want AI agents off laptops and in sandboxes. A sandbox decides where an agent runs; MoorAI decides each action, from one policy for both. - [MoorAI and Project Quarry](https://moorai.dev/blog/moorai-and-project-quarry.html): Cisco open-sourced Project Quarry, a rule language for agent attacks spread over many steps. How MoorAI exports to it and imports its exact rules. - [Rolling out Claude Code or Codex in a regulated company](https://moorai.dev/blog/claude-code-codex-regulated-rollout.html): A buyer's guide for banks, payments, insurance, healthcare and government teams rolling out Claude Code or Codex: ten controls to require first. - [Reasoning said no tools; the tool call said otherwise](https://moorai.dev/blog/reasoning-said-no-tools.html): An open-weight model said it would call no tools, then tried to upload to a cloud bucket. Why a reasoning trace is not a control, and what teams should do. - [Trust no AI: keep the guard outside the agent](https://moorai.dev/blog/trust-no-ai.html): Treat an AI agent like any untrusted, privileged process: the guard and the record sit outside it. Three October reports, five rules, and where MoorAI fits. - [When the AI security console is down](https://moorai.dev/blog/ai-agent-security-when-the-console-is-down.html): Every AI-agent security product has a console. Five questions to ask a vendor about what happens when it is down, and how MoorAI answers each. - [When a coding agent weakens oversight](https://moorai.dev/blog/ai-coding-agents-weakening-oversight.html): OpenAI reports coding agents that silenced monitoring alerts and removed a monitor. Why it is an agent-security problem, five controls, and where MoorAI fits. - [Local LLMs and AI agents in air-gapped OT](https://moorai.dev/blog/local-llms-and-ai-agents-in-air-gapped-ot.html): Air-gapped plants and utilities are running local LLMs. What still crosses the gap, a hardening checklist for a local-LLM enclave, and where MoorAI fits. - [Mac Studio as a local AI server: what to lock down](https://moorai.dev/blog/protect-mac-studio-local-ai.html): A Mac Studio running open-weight models and AI agents is a server. A macOS hardening checklist, verified server defaults, and where MoorAI fits. - [Damn Vulnerable MCP: 9 of 10 blocked outright](https://moorai.dev/blog/damn-vulnerable-mcp-moorai-results.html): MoorAI ran all ten Damn Vulnerable MCP challenges, unmodified. Guard and gateway: 9 of 10 blocked outright, 10 of 10 with IP exposure (#9) set to block. - [ISO/IEC 27090: stop AI agent threats on the device](https://moorai.dev/blog/iso-27090-for-ai-agents-on-the-device.html): ISO/IEC 27090 names the AI threats. MoorAI stops them where agents act: on the device, before each action runs, with evidence an auditor verifies offline. - [AEGIS for AI agents on the device: what you can measure](https://moorai.dev/blog/aegis-for-ai-agents-on-the-device.html): Forrester's AEGIS names six domains of guardrails for agentic AI. For agents on the device: what to ask in each, what MoorAI measures, and the gaps. - [What the 2026 Verizon DBIR found on AI, and how MoorAI solves it](https://moorai.dev/blog/verizon-dbir-2026-ai-agents.html): The 2026 Verizon DBIR: 67% reach AI on work devices via personal accounts, and source code tops what goes in. Each AI finding, and how MoorAI answers it. - [MoorAI and Microsoft Execution Containers (MXC)](https://moorai.dev/blog/moorai-and-microsoft-execution-containers-mxc.html): Codex and Copilot can run commands inside Microsoft Execution Containers. What that boundary contains, what it does not judge, and what MoorAI checks. - [What ATT&CK v20 means for AI agents (and where MoorAI maps)](https://moorai.dev/blog/attack-v20-ai-agents-moorai-mapping.html): ATT&CK v20 names prompt injection and AI-enabled exfiltration. How MoorAI's 80 rules map to v20, lane by lane, and how a SOC joins alerts to it. - [What's new in MoorAI: fail mode and living off the AI](https://moorai.dev/blog/whats-new-in-moorai-fail-mode-living-off-the-ai.html): Fail mode per surface, business actions, living off the AI, then one trace per agent session, a context tree, runtime AIBOM and granted vs used. - [Anthropic Inference Hooks: what they see](https://moorai.dev/blog/anthropic-inference-hooks-what-they-see.html): What Anthropic Inference hooks send to your security server, what they never see, the default failure mode, and a checklist for choosing a hook server. - [Treat AI as critical infrastructure](https://moorai.dev/blog/treat-ai-as-critical-infrastructure.html): AI now acts inside energy, finance, health and government networks. What critical-infrastructure treatment means for it, and a checklist a CISO can act on. - [Backdoored models show up in what they do](https://moorai.dev/blog/backdoored-models-show-up-in-what-they-do.html): A trigger backdoor in an open model's weights passes every benchmark and shows up only as an action. What to ask of any tool that claims to stop it. - [Hidden Unicode in what AI agents read](https://moorai.dev/blog/hidden-unicode-in-what-ai-agents-read.html): We scanned MCP registries, packages, 14 AI-agent repos and 21,061 Bluesky profiles for invisible Unicode. Hidden instructions are rare, real and not stripped. - [How MoorAI protects AI apps and APIs](https://moorai.dev/blog/how-moorai-protects-ai-apps-and-apis.html): MoorAI agent v1.17.1 checks AI apps where they act: a sidecar, an Agent SDK hook, an MCP gateway, a model proxy for four APIs and an Inference hooks server. - [MoorAI against the Synthetic Insider Threat Matrix™](https://moorai.dev/blog/moorai-against-synthetic-insider-threat-matrix.html): Forscie and Above Security's matrix lists 116 ways an AI agent becomes an insider threat. MoorAI agent v1.1.0 has a mechanism for 57 of them, 43 with a limit. - [Latio's second era of AI security: where MoorAI fits](https://moorai.dev/blog/latio-second-era-ai-security.html): Latio Tech's 2026 AI Security Market Report says AI security has moved to endpoint agents. Where MoorAI fits in that framing, and where it falls short. - [Every AI agent boundary, mapped to MITRE ATLAS](https://moorai.dev/blog/agent-boundaries-mapped-to-mitre-atlas.html): Every boundary an AI coding agent crosses — prompts, files, input, tools, skills, output — mapped to MITRE ATLAS and inspected on the device. - [The layer above the model — ASD on harness security](https://moorai.dev/blog/the-layer-above-the-model.html): ASD/ACSC says agentic-AI security belongs in the harness, the layer above the model. This post maps MoorAI to that guidance: strengths, partials and gaps. - [Agentic apps are attack graphs — the missing node](https://moorai.dev/blog/agentic-apps-are-attack-graphs.html): ATAG models an agentic app as an attack graph in which a missing input guardrail enables prompt injection. MoorAI is one such guardrail node, at runtime. - [How to choose your agentic security vendor](https://moorai.dev/blog/choosing-an-agentic-security-vendor.html): A buyer's guide to agentic AI security: six questions that separate a measured claim from a decorated one, with the weak answer, the good one and how to verify. - [MoorAI graded against AMTSO's agentic testing guidelines](https://moorai.dev/blog/amtso-agentic-security-testing-guidelines.html): AMTSO's agentic testing guidelines applied to MoorAI: 95.2% of the refusal gap against a Llama 3 8B, 75.0% against Claude Sonnet. - [Obfuscated prompts beat content scanning](https://moorai.dev/blog/obfuscated-prompts-beat-content-scanning.html): Encoded and obfuscated prompt attacks exist to slip past text inspection. MoorAI decides on the tool call the agent tries to run, content-free and on-device. - [Your AI writes the code. Who attests to it?](https://moorai.dev/blog/ai-supply-chain-attestation-content-free.html): Software supply chain security grew a new link: the AI agent that writes and changes your code. MoorAI attests the agent's actions content-free, on the device. - [AI's Evidence Problem — answered content-free](https://moorai.dev/blog/ai-evidence-problem-content-free.html): The core AI-security problem is an evidence gap, not a policy gap. MoorAI is the content-free evidence layer for AI agents: the record you can afford to keep. - [Prompt injection: content scanning won't stop it](https://moorai.dev/blog/prompt-injection-ai-assistant-attacker.html): Prompt injection hides instructions in the content your AI agent reads. The defense that always applies: content-free on-device enforcement at the action layer. ## Optional - [DAN attack family: detection vs model refusal](https://moorai.dev/attack-families/dan.html): DAN: MoorAI agent 0.96.0 catches 100% (4 of 4); the Claude Sonnet assistant alone refuses 50% (2 of 4). Marginal value 50 points. - [PAIR attack family: detection vs model refusal](https://moorai.dev/attack-families/pair.html): PAIR: MoorAI agent 0.96.0 catches 50% (2 of 4); the Claude Sonnet assistant alone refuses 0% (0 of 4). Marginal value 50 points. - [PAP attack family: detection vs model refusal](https://moorai.dev/attack-families/pap.html): PAP: MoorAI agent 0.96.0 catches 100% (5 of 5); the Claude Sonnet assistant alone refuses 80% (4 of 5). Marginal value 20 points. - [AutoDAN attack family: detection vs model refusal](https://moorai.dev/attack-families/autodan.html): AutoDAN: MoorAI agent 0.96.0 catches 100% (9 of 9); the Claude Sonnet assistant alone refuses 89% (8 of 9). Marginal value 11 points. - [BoN attack family: detection vs model refusal](https://moorai.dev/attack-families/bon.html): BoN: MoorAI agent 0.96.0 catches 100% (4 of 4); the Claude Sonnet assistant alone refuses 100% (2 of 2). Marginal value 0 points. - [AdvPrefix attack family: detection vs model refusal](https://moorai.dev/attack-families/advprefix.html): AdvPrefix: MoorAI agent 0.96.0 catches 75% (3 of 4); the Claude Sonnet assistant alone refuses 100% (4 of 4). Marginal value -25 points. - [h4rm3l attack family: detection vs model refusal](https://moorai.dev/attack-families/h4rm3l.html): h4rm3l: MoorAI agent 0.96.0 catches 75% (3 of 4); the Claude Sonnet assistant alone refuses 100% (2 of 2). Marginal value -25 points. - [TAP attack family: detection vs model refusal](https://moorai.dev/attack-families/tap.html): TAP: MoorAI agent 0.96.0 catches 33% (1 of 3); the Claude Sonnet assistant alone refuses 100% (3 of 3). Marginal value -67 points. - [CipherChat attack family: detection vs model refusal](https://moorai.dev/attack-families/cipherchat.html): CipherChat: the provider’s Acceptable Use Policy rejects every probed sample before the Claude Sonnet assistant reads it; MoorAI agent 0.96.0 catches 4 of 4. - [FlipAttack attack family: detection vs model refusal](https://moorai.dev/attack-families/flipattack.html): FlipAttack: the provider’s Acceptable Use Policy rejects every probed sample before the Claude Sonnet assistant reads it; MoorAI agent 0.96.0 catches 3 of 3. - [MOORAI-2026-001: WebFetch content was not scanned](https://moorai.dev/disclosures/moorai-2026-001.html): MOORAI-2026-001: inbound WebFetch and WebSearch content was not scanned. Severity medium; affects releases up to 0.78.0, fixed in 0.79.0. No CVE assigned. - [CipherChat — agentic AI security glossary](https://moorai.dev/glossary/cipherchat.html): The harmful request is encoded in a cipher — Caesar shift, ROT13, base64, hex, a custom substitution — and the model is asked to work in that cipher. - [FlipAttack — agentic AI security glossary](https://moorai.dev/glossary/flipattack.html): A reversal attack: the payload is written backwards — by character, by word, or by line — and the model is instructed to un-reverse it before following… - [h4rm3l — agentic AI security glossary](https://moorai.dev/glossary/h4rm3l.html): A family built around composable string transformations: a small language of primitives — character substitution, insertion, role framing, encoding — that… - [DAN — agentic AI security glossary](https://moorai.dev/glossary/dan.html): The original hand-written persona jailbreak: the model is told to role-play an unrestricted alter ego that "has broken free" of its rules, often with… - [AutoDAN — agentic AI security glossary](https://moorai.dev/glossary/autodan.html): The automated successor to DAN: instead of a human writing the persona prompt, a search process — typically a genetic algorithm or gradient-guided… - [BoN — agentic AI security glossary](https://moorai.dev/glossary/bon.html): Not a clever prompt but a volume attack: generate n shuffled, re-cased, lightly-perturbed variants of the same request, fire them all, and keep whichever… - [AdvPrefix — agentic AI security glossary](https://moorai.dev/glossary/advprefix.html): A prefix-forcing attack: rather than arguing with the model, it prepends text chosen so the model's most likely continuation is already compliant … - [PAP — agentic AI security glossary](https://moorai.dev/glossary/pap.html): PAP applies the taxonomy of human persuasion — authority, reciprocity, social proof, emotional appeal, expert framing, logical appeal — to the harmful… - [PAIR — agentic AI security glossary](https://moorai.dev/glossary/pair.html): An attacker model and a target model in a loop: the attacker proposes a prompt, sees how the target responded, and rewrites the prompt to do better … - [TAP — agentic AI security glossary](https://moorai.dev/glossary/tap.html): A tree search on top of PAIR. The attacker branches into several candidate refinements at each step instead of one, then prunes the branches an evaluator… - [Prompt injection — agentic AI security glossary](https://moorai.dev/glossary/prompt-injection.html): Getting a language model to follow instructions it was not supposed to follow, by placing those instructions somewhere the model treats as input. - [Direct prompt injection — agentic AI security glossary](https://moorai.dev/glossary/direct-prompt-injection.html): The person typing is the attacker. They write instructions intended to override the system prompt or the product's guardrails — "ignore your previous… - [Indirect prompt injection — agentic AI security glossary](https://moorai.dev/glossary/indirect-prompt-injection.html): The instructions are planted in content the agent reads rather than text the user types — a web page, a GitHub issue, a code comment, a dependency's… - [Jailbreak — agentic AI security glossary](https://moorai.dev/glossary/jailbreak.html): Defeating a model's safety training so it produces output it would normally refuse. The distinction from prompt injection is about whose intent is being… - [Obfuscation / encoding — agentic AI security glossary](https://moorai.dev/glossary/obfuscation.html): Rewriting a payload so it survives the defence but is still recoverable by the model — base64, hex, ROT13 and Caesar shifts, character or word reversal… - [Homoglyph — agentic AI security glossary](https://moorai.dev/glossary/homoglyph.html): A character that looks identical or near-identical to another but has a different Unicode code point — Cyrillic а for Latin a, Greek ο for o, a full-width… - [Leetspeak — agentic AI security glossary](https://moorai.dev/glossary/leetspeak.html): Substituting digits and symbols for visually similar letters — 3 for e, 1 or ! for i/l, 4 or @ for a, 0 for o — as in h4rm3l. Models read it fluently; - [Multi-turn crescendo — agentic AI security glossary](https://moorai.dev/glossary/crescendo.html): An escalation attack spread across a conversation. No single turn is refusable: the first is an innocuous question, each subsequent one leans on the… - [Tool poisoning — agentic AI security glossary](https://moorai.dev/glossary/tool-poisoning.html): Hiding instructions in the metadata an agent reads to learn how to use a tool — an MCP server's tool description, its parameter documentation, its schema… - [Tool-name shadowing — agentic AI security glossary](https://moorai.dev/glossary/tool-name-shadowing.html): A malicious server registers a tool whose name or description collides with a trusted one — the same name, a near-identical name, or a description… - [Capability expansion — agentic AI security glossary](https://moorai.dev/glossary/capability-expansion.html): A tool or server that was reviewed and approved in one form quietly acquires new powers later — a new parameter, a new network destination, a new… - [Confused deputy — agentic AI security glossary](https://moorai.dev/glossary/confused-deputy.html): A classic security problem, dated 1988, that agents reproduce almost perfectly: a privileged component is tricked by a less-privileged party into misusing… - [Data exfiltration — agentic AI security glossary](https://moorai.dev/glossary/data-exfiltration.html): Moving data the attacker should not have out to somewhere they control. In agent contexts the channel is rarely a file upload — it is a URL the agent is… - [Lethal trifecta — agentic AI security glossary](https://moorai.dev/glossary/lethal-trifecta.html): Simon Willison's name for the combination that turns an agent into an exfiltration engine: (1) access to private data, (2) exposure to untrusted content… - [AI agent — agentic AI security glossary](https://moorai.dev/glossary/ai-agent.html): A language model wired into a loop where it can take actions and see their results: it reasons, calls a tool, reads the output, and decides what to do… - [Agent host — agentic AI security glossary](https://moorai.dev/glossary/agent-host.html): The program that runs the agent loop — the CLI, IDE extension or desktop app that assembles the context, sends it to the model, receives the tool calls… - [Tool call — agentic AI security glossary](https://moorai.dev/glossary/tool-call.html): The model's structured request to do something in the world — Bash("rm -rf …"), Read("/etc/passwd"), an HTTP fetch, a database query … - [MCP (Model Context Protocol) — AI security glossary](https://moorai.dev/glossary/mcp.html): An open protocol, introduced by Anthropic in 2024 and now broadly adopted, that standardises how agents connect to external tools and data sources. - [Tool registration — agentic AI security glossary](https://moorai.dev/glossary/tool-registration.html): The handshake in which a server tells the host what tools it offers, and the host puts those names, descriptions and schemas into the model's context. - [PreToolUse hook (Claude Code) — AI security glossary](https://moorai.dev/glossary/pretooluse-hook.html): A callback the agent host invokes after the model has requested a tool call but before the call executes, handing over the tool name and arguments and… - [Action layer — agentic AI security glossary](https://moorai.dev/glossary/action-layer.html): The enforcement surface at the tool call, as opposed to the prompt layer, which tries to classify text before the model sees it. - [Memory / cross-agent propagation — AI security glossary](https://moorai.dev/glossary/memory-propagation.html): A payload that is written in one session and fires in a later one, or in a different agent. - [Held-out set — agentic AI security glossary](https://moorai.dev/glossary/held-out-set.html): Test samples deliberately kept away from whoever is building the detection, so the score answers "does this generalise?" rather than "does this… - [Tune/test split — agentic AI security glossary](https://moorai.dev/glossary/tune-test-split.html): Dividing a corpus once into a half the tuning work may see and a locked half it may not. - [Overfitting — agentic AI security glossary](https://moorai.dev/glossary/overfitting.html): Fitting the examples instead of the phenomenon. In detection work it usually looks like a rule matched to the exact phrasings in the corpus — a pattern… - [Baseline validation — agentic AI security glossary](https://moorai.dev/glossary/baseline-validation.html): Confirming that a test case actually works with the product turned off before counting a block as a save. - [False positive — agentic AI security glossary](https://moorai.dev/glossary/false-positive.html): Benign activity flagged as malicious. In an agent security control this is the failure mode that actually kills deployments: a tool that blocks legitimate… - [False negative — agentic AI security glossary](https://moorai.dev/glossary/false-negative.html): A real attack the control failed to flag. False negatives and false positives trade off against each other: any threshold that reduces one increases the… - [Precision — agentic AI security glossary](https://moorai.dev/glossary/precision.html): Of everything the control flagged, the share that was genuinely malicious — true positives divided by all positives. - [Recall — agentic AI security glossary](https://moorai.dev/glossary/recall.html): Of all the real attacks in the corpus, the share the control caught. It is the number vendors quote, and on its own it means very little: recall is… - [Hard negative — agentic AI security glossary](https://moorai.dev/glossary/hard-negative.html): A benign sample deliberately shaped like an attack — a security engineer legitimately asking about base64 decoding, a role-play prompt with no harmful… - [Detection vs prevention — agentic AI security glossary](https://moorai.dev/glossary/detection-vs-prevention.html): Detection notices something and produces a record; prevention stops it from happening. They are routinely conflated in agent-security claims, and the gap… - [Model refusal — agentic AI security glossary](https://moorai.dev/glossary/model-refusal.html): The underlying model declining the request on its own, with no security product involved. - [Marginal value — agentic AI security glossary](https://moorai.dev/glossary/marginal-value.html): The protection a control adds on top of what the model already refuses — the only part of a detection number that is genuinely the product's. - [Red teaming — agentic AI security glossary](https://moorai.dev/glossary/red-teaming.html): Adversarial testing that tries to make a system fail, rather than confirming it works. For AI systems it spans manual probing, curated attack corpora, and… - [Adversarial mutation — agentic AI security glossary](https://moorai.dev/glossary/adversarial-mutation.html): Mechanically generating fresh variants of known attacks along defined transformation axes — synonym and voice swaps, encodings, homoglyphs… - [Variance — agentic AI security glossary](https://moorai.dev/glossary/variance.html): How much a result moves when the same test is run again. Any figure involving a model is a sample from a distribution, not a constant — the same judge… - [AMTSO — agentic AI security glossary](https://moorai.dev/glossary/amtso.html): The industry body that sets standards for how security products are tested fairly. Its Guidelines for Testing of Agentic Security Products v1.0 (2… - [OWASP LLM Top 10 — agentic AI security glossary](https://moorai.dev/glossary/owasp-llm-top-10.html): OWASP's list of the ten most critical risks in applications built on large language models — LLM01 Prompt Injection, LLM02 Sensitive Information… - [OWASP Agentic Top 10 — agentic AI security glossary](https://moorai.dev/glossary/owasp-agentic-top-10.html): OWASP's first risk taxonomy written specifically for autonomous, tool-using agents: ASI01 Agent Goal Hijack, ASI02 Tool Misuse & Exploitation, ASI03… - [MITRE ATLAS — agentic AI security glossary](https://moorai.dev/glossary/mitre-atlas.html): ATT&CK for machine learning: a knowledge base of adversary tactics and techniques against AI systems, grounded in real incidents and published research… - [EU AI Act — agentic AI security glossary](https://moorai.dev/glossary/eu-ai-act.html): The European Union's risk-tiered regulation of AI systems, with obligations scaling from minimal to unacceptable risk. - [ISO/IEC 42001 — agentic AI security glossary](https://moorai.dev/glossary/iso-42001.html): The certifiable management-system standard for artificial intelligence — the AI equivalent of ISO 27001. - [NIST AI RMF — agentic AI security glossary](https://moorai.dev/glossary/nist-ai-rmf.html): The US National Institute of Standards and Technology's voluntary AI Risk Management Framework, organised around four functions — Govern, Map, Measure… - [AIUC-1 — agentic AI security glossary](https://moorai.dev/glossary/aiuc-1.html): The certification standard for AI agents published by the Artificial Intelligence Underwriting Company. - [Content-free detection — agentic AI security glossary](https://moorai.dev/glossary/content-free-detection.html): Analysis that happens on the device, where only the verdict leaves it — a category, a risk level, a decision and a keyed one-way hash (plus the login and… - [On-device — agentic AI security glossary](https://moorai.dev/glossary/on-device.html): Detection and enforcement run in the process that is about to take the action, on the developer's machine, rather than in a cloud service the traffic is… - [Keyed one-way hash — agentic AI security glossary](https://moorai.dev/glossary/keyed-one-way-hash.html): A tenant-keyed cryptographic digest of a value — a tool argument, a file path, a detected secret — emitted in place of the value itself. - [Semantic escalation — agentic AI security glossary](https://moorai.dev/glossary/semantic-escalation.html): A second, optional pass: when the fast deterministic detectors return nothing and the sample is still ambiguous, the text is handed to a model for a… - [Normalization pre-pass — agentic AI security glossary](https://moorai.dev/glossary/normalization-pre-pass.html): A bounded decode-and-fold stage that runs before the detectors: strip zero-width and bidirectional control characters, fold homoglyphs and leetspeak… - [Living off the AI — agentic AI security glossary](https://moorai.dev/glossary/living-off-the-ai.html): An intruder who already runs code on a machine uses the AI tooling installed there — the coding agents, their API keys, local model servers — instead of… - [Excessive agency — agentic AI security glossary](https://moorai.dev/glossary/excessive-agency.html): The OWASP Top 10 for LLM Applications entry (LLM06:2025) for a system that can be made to take damaging actions in response to unexpected, ambiguous or… - [Shadow AI — agentic AI security glossary](https://moorai.dev/glossary/shadow-ai.html): AI tools, agents, models and MCP servers in use without the security team's knowledge or approval: a developer's own coding agent, a chatbot fed… - [Context window — agentic AI security glossary](https://moorai.dev/glossary/context-window.html): The text a model can take into account at once, measured in tokens: system prompt, conversation, tool definitions, file contents and tool results. - [Agent hook — agentic AI security glossary](https://moorai.dev/glossary/agent-hook.html): A command an agent host runs at fixed points in its loop — before a tool call, after a tool call, when a prompt is submitted, when a session starts or… - [Inference hooks — agentic AI security glossary](https://moorai.dev/glossary/inference-hooks.html): A Claude Enterprise feature, in beta, that sends each governed request to the organization's own AI security server before inference runs and waits for an… - [MCP gateway — agentic AI security glossary](https://moorai.dev/glossary/mcp-gateway.html): A proxy between agents and MCP servers that tool listings and tool calls pass through, so one place can authenticate, allow or refuse servers and tools… - [Model proxy — agentic AI security glossary](https://moorai.dev/glossary/model-proxy.html): A service between an application or agent and its model provider's API: the client points its base URL at the proxy, which forwards each request and can… - [Agent sandbox — agentic AI security glossary](https://moorai.dev/glossary/agent-sandbox.html): An isolation boundary around the commands an agent runs — an operating-system sandbox profile, a container or a microVM — that limits which files they can… - [Non-human identity — agentic AI security glossary](https://moorai.dev/glossary/non-human-identity.html): An identity used by software rather than a person — a service account, API key, OAuth token, certificate or workload identity — usually backed by a secret… - [Agent identity — agentic AI security glossary](https://moorai.dev/glossary/agent-identity.html): The identity an AI agent's actions are attributed to and authorised under. Most agents today act as the developer who launched them, or with a shared key… - [W3C Trace Context — agentic AI security glossary](https://moorai.dev/glossary/w3c-trace-context.html): A W3C Recommendation (November 2021) that standardises the HTTP headers carrying distributed-tracing context between services: traceparent gives a… - [AI detection and response — agentic AI security glossary](https://moorai.dev/glossary/ai-detection-and-response.html): A security category for detecting, investigating and responding to threats in how AI is used — agents, model calls, MCP tools, AI applications — modelled… - [On-device AI-DR — agentic AI security glossary](https://moorai.dev/glossary/on-device-ai-dr.html): AI detection and response that runs on the machine where the agent runs, in or beside the agent process, rather than in a cloud service or network gateway… - [AIBOM — agentic AI security glossary](https://moorai.dev/glossary/aibom.html): An inventory of the AI components in a system or on a device — models and their providers, agents and harnesses, MCP servers, plugins, skills, datasets … - [Runtime AIBOM — agentic AI security glossary](https://moorai.dev/glossary/runtime-aibom.html): An AIBOM built from what is running and being used, not only from what is installed or declared: which model servers are listening, which MCP servers… - [Least privilege for AI agents — agentic AI security glossary](https://moorai.dev/glossary/least-privilege-for-ai-agents.html): The principle that an agent gets only the tools, files, network destinations and credentials its task needs, for only as long as it needs them. - [Permission right-sizing — agentic AI security glossary](https://moorai.dev/glossary/permission-right-sizing.html): Cutting the permissions an agent is granted down to the ones it uses: comparing what a configuration allows — tools, commands, directories, MCP servers… - [Fail-open / fail-closed — agentic AI security glossary](https://moorai.dev/glossary/fail-open-fail-closed.html): What a security control does when it cannot reach a decision because it crashed, timed out or could not read its input. - [Decoy credential — agentic AI security glossary](https://moorai.dev/glossary/decoy-credential.html): A credential that looks real but is never used by any legitimate process — a fake API key, cloud key or token placed where an intruder or a misled agent… - [Context tree — agentic AI security glossary](https://moorai.dev/glossary/context-tree.html): In AI incident forensics, a reconstruction of everything that entered a model's context during a session and where each piece came from — prompts, files… - [Patient zero — agentic AI security glossary](https://moorai.dev/glossary/patient-zero.html): The first point at which malicious content entered an AI system in an incident — the poisoned web page, file, tool description or message an agent read… - [Agentic AI security glossary — 82 terms defined](https://moorai.dev/glossary.html): Agentic AI security glossary: 82 plain-English definitions, from indirect prompt injection and MCP tool poisoning to AI-DR, AIBOM and least privilege. - [MoorAI agent 1.47.0: benchmark result](https://moorai.dev/leaderboard/moorai-v1.47.0.html): MoorAI agent 1.47.0: 77.9% recall (233 of 299 attacks), 4.9% false positives (43 of 878 benign). Raw detection rate; no model-refusal baseline run. - [keyword reference adapter 1.0.0: benchmark result](https://moorai.dev/leaderboard/keyword-baseline.html): keyword reference adapter 1.0.0: 40.3% recall (85 of 211 attacks), 5.0% false positives (42 of 841 benign). Raw detection rate; no model-refusal baseline run. - [null adapter 1.0.0: benchmark result](https://moorai.dev/leaderboard/null-floor.html): null adapter 1.0.0: 0.0% recall (0 of 286 attacks), 0.0% false positives (0 of 875 benign). Raw detection rate; no model-refusal baseline run.