The OWASP Agentic Top 10, and how MoorAI aligns
OWASP's first risk taxonomy written for autonomous, tool-using agents (goal hijack, tool misuse, unexpected code execution, memory poisoning, rogue agents) is where buyers and auditors start the agent-security conversation. MoorAI was built for exactly this surface: the coding agent's in-process tool call, decided on the device. Below is an architecture-level alignment of MoorAI's 85-threat matrix to each ASI item. It is not an OWASP-certified mapping, and it marks the items that belong to the identity, orchestration, or model layer rather than the endpoint.
The model layer decides what an agent wants; the tool layer decides what it can, and only the second is enforceable. Most of the agentic Top 10 lives at that second layer, at the moment a tool call is about to run. That is where MoorAI sits, on the machine, before execution, emitting only category · risk · keyed one-way hash (plus the login and hostname, which the console pseudonymises on arrival).
Scroll sideways →
| Risk | What it is | How MoorAI aligns |
|---|---|---|
| ASI01Agent Goal Hijack | An attacker alters the agent's objective through malicious content — a poisoned rules file, a prompt-injection payload, or instructions hidden in something the agent later reads. | Direct control Content-free rules-file analysis ( CLAUDE.md, .cursorrules, skill files), multilingual prompt-injection detection (~29 languages), and second-order / indirect-injection detection in files, RAG payloads, and OCR'd images — caught before the instruction can steer the agent. On Claude Code, a risky call aimed at a host, path or service the user's own request never named is reported as outside the stated task; the check is lexical, so a host the user named passes. |
| ASI02Tool Misuse & Exploitation | The agent uses legitimate tools in unsafe ways — over-broad arguments, a destructive command, a tool call that does more than the task needed. | Direct control The PreToolUse hook evaluates every tool call on the device before it runs, with per-tool MCP argument rules and destructive-command detection. One of MoorAI's deepest areas: validated end to end on Claude Code; Codex and Copilot CLI block through their pre-tool hooks but are not yet validated against the live agents. A curl, wget or Invoke-WebRequest upload to public cloud storage or a pre-signed URL is flagged (threat #86, reported by default, ask or block by policy). |
| ASI03Identity & Privilege Abuse | Agents inherit or escalate high-privilege credentials — over-scoped tokens, standing secrets, access that outlives the task. | Adjacent MoorAI blocks secrets from being read into agent context and constrains reach with a per-agent entitlement envelope and destination map. It governs the action, not the credential lifecycle — token issuance, rotation, and just-in-time scoping belong to a non-human-identity (NHI) product. Run MoorAI as the action-layer complement to one, not a replacement. |
| ASI04Agentic Supply-Chain Vulnerabilities | Compromised or unvetted MCP servers, plugins, skills, models, or extensions entering the agent stack — the way the first malicious MCP server reached real machines in 2026. | Direct control An approved-MCP allow-list enforced at call time, per-tool argument rules, content-free Skill Analysis, and an on-device AIBOM inventorying models, MCP servers, tools, and skills with capability-scope risk (network / filesystem / credential). A clean server that ships one exfil line in a later release is blocked at the call, not trusted by reputation. Each server also gets a content-free reputation score on first sight and on a version change (typosquatting, pinning, install scripts), which an org can enforce as a minimum. |
| ASI05Unexpected Code Execution | The agent generates or runs code and shell commands unsafely — curl | bash, an unreviewed script, a command with a scope nobody intended. |
Direct control Bash / shell interception at the tool-call boundary, before execution, with destructive-command and risky-pattern detection. The decision is made in-process, so a command that never generates network traffic is still governable. |
| ASI06Memory & Context Poisoning | Attackers poison the agent's memory or its RAG / index so a planted directive fires on a later read and steers future behavior. | Direct control Secret-read-into-context blocking, content-free rules- and skill-file analysis, memory-poisoning detection when the agent writes an instruction into its own memory or instruction files, an alert on any write into those files with no policy needed (direct, through an MCP filesystem tool, or by a shell copy, move, download, patch or in-place edit), labels for instructions a skill hides by padding, HTML comments, concealment wording or text aimed at a reviewer, and scanning of documents before they are embedded into a vector store (Agent SDK, local sidecar, MCP vector-store writes), plus hidden-instruction and invisible-text detection (zero-width, bidirectional / Trojan-Source characters) in content the agent reads. Second-order injection is caught at the read, not just the prompt. |
| ASI07Insecure Inter-Agent Communication | Multi-agent systems face spoofing and tampering across the channels agents use to talk to each other and to tool servers. | Partial MoorAI governs the tool-call surface each agent uses — the MCP allow-list at call time, per-tool argument rules, and lethal-trifecta / cross-server toxic-flow detection. Full agent-to-agent (A2A) channel authentication and message integrity across an orchestration is broader than one endpoint's view; MoorAI covers the tool-boundary slice of it, not the whole protocol. |
| ASI08Cascading Failures | A small error propagates across planning and execution — one bad step compounding through connected agents and systems. | Detect & reconstruct Per-agent assurance score, machine-speed burst / loop detection via the autonomous-agent-behavior signature, and content-free trace / session replay that reconstructs the full action chain for investigation without surfacing a prompt. MoorAI flags and records runaway behavior; multi-agent orchestration-level failure isolation sits above the endpoint. |
| ASI09Human-Agent Trust Exploitation | Users over-trust the agent — approving a risky action, accepting a recommendation, or rubber-stamping a workflow the agent nudged them toward. | Aligned Human-in-the-loop by design: coach, alert, block, or require a signed justification, set per policy. The override carries a content-free intent log, so a human decision to proceed is recorded as evidence rather than an invisible click — a friction point exactly where blind trust would otherwise pass. |
| ASI10Rogue Agents | A compromised or misbehaving agent acts harmfully while still appearing legitimate. | Direct control Per-agent assurance score, a destination map of what each agent actually reaches, and an entitlement envelope enforced locally at the tool call — plus a cryptographically signed, tamper-evident, content-free decision record, so a rogue agent's behavior is bounded and provable after the fact. An agent's own edit or command that weakens the project's monitoring, alerting, audit logging or safety tests (threat #84) asks for approval by default, and on Claude Code its final message is checked for whether it says so (when a coding agent weakens oversight). |
This is an architecture-level alignment of MoorAI's on-device detectors to the OWASP Top 10 for Agentic Applications (ASI01–ASI10, 2026), not an OWASP-certified or official mapping. ASI item names are taken from the published OWASP taxonomy and corroborating secondary sources (Promptfoo, Cycode); verify item specifics against the current OWASP resource. Direct control = MoorAI enforces the item on-device; Partial / Aligned / Adjacent = MoorAI covers a slice, with the rest at the identity or orchestration layer; Detect & reconstruct = MoorAI flags and records, but does not itself isolate. Content-free by default: category, risk level, and a keyed one-way hash, never prompt or file content; the one exception is an opt-in capture tier an administrator can turn on explicitly. The agent is open source (MIT), so the behavior is auditable. OWASP® is a trademark of the OWASP Foundation.