The OWASP LLM Top 10, item by item
What each risk is, and how MoorAI covers it on the device. Where MoorAI is deep, the table says so; where an item belongs to the model or gateway layer, it says that too. MoorAI focuses on AI agents (Claude Code, Codex, Copilot) and keeps prompt content on the machine.
Scroll sideways →
| Risk | What it is | MoorAI coverage |
|---|---|---|
| LLM01Prompt Injection | Crafted input overrides the model's instructions — directly ("ignore previous instructions…") or indirectly, via instructions hidden in content the agent later reads. | Multilingual injection detection (~29 languages) on prompts, plus second-order / indirect-injection detection in files read into context, RAG payloads, and OCR'd images. |
| LLM02Sensitive Information Disclosure | Secrets, PII, or proprietary source leaking into a prompt, into an agent's context, or back out in a response. | The DLP core — ~14 provider secret families plus PII and source detection across prompts, context reads, MCP tool-call arguments, and outputs, with a content-free exposure ledger for targeted incident-response rotation. |
| LLM03Supply Chain | Compromised or unvetted models, MCP servers, plugins, editor extensions, or datasets entering the agent stack. | On-device AIBOM inventories models and MCP servers with capability-scope risk (network / filesystem / credential); unapproved, risky, and high-risk MCP servers are flagged, alongside editor AI-extension and skill provenance. Each MCP server also gets a 0–100 reputation score on first sight and on a version change (typosquatting, unpinned versions, install scripts), and an org can refuse servers below a minimum score. |
| LLM04Data & Model Poisoning | Poisoned training data or corrupted model / agent memory that biases future behavior. | Flags an agent writing an instruction into its own memory or instruction files (CLAUDE.md, AGENTS.md, auto-memory, rules, skills) that would send data out, hide something from the user, skip a check or override its rules in future sessions. Training-data and model poisoning are a pipeline / model-provider concern outside the endpoint's view. |
| LLM05Improper Output Handling | Unsafe or unsanitized model output (echoed secrets, injected code, curl | bash, unverifiable citations) consumed downstream without checks. |
Output-stage review with secret-span redaction: MoorAI checks what the agent says back as well as what's typed, and masks flagged spans on the reply path. |
| LLM06Excessive Agency | The agent can do more than it should — over-broad tool access, unapproved servers, actions taken without bounds. | Agency Enforcement: an approved-MCP allow-list enforced at call time (non-allow-listed servers blocked) plus tool-call argument inspection. One of MoorAI's deepest areas, and the direct control for LLM06. |
| LLM07System Prompt Leakage | The system / developer prompt — which may hold rules, config, or secrets — is extracted by a probe or recited back in the model's output. | Extraction-probe detection on prompts ("repeat the words above", "print your system prompt") plus system-prompt / instruction-echo detection on outputs. The agent’s own rules files (CLAUDE.md, AGENTS.md, Copilot and Cursor rules) are fingerprinted on the device as keyed hashes, and a substantial copy leaving in output, an upload or MCP arguments is reported; a paraphrase is not matched. |
| LLM08Vector & Embedding Weaknesses | RAG poisoning, indirect injection embedded in retrieved content, and embedding manipulation that steers the model. | Documents are scanned before they are embedded into a vector store, through the Agent SDK, the local sidecar and MCP vector-store write tools, for instructions aimed at the AI that will retrieve them and for hidden or invisible text (zero-width and bidirectional / Trojan-Source characters). An app that embeds without calling MoorAI is not covered. Embedding inversion and cross-tenant vector leakage are model-layer concerns, out of the endpoint's scope. |
| LLM09Misinformation | Hallucinated, unreliable, or manipulated output — and over-reliance on it without verification. | Reliability and advisory detectors plus second-order / hidden-instruction rules, coaching users on unverified or unsafe claims at the point of use. |
| LLM10Unbounded Consumption | Resource and cost blowups — token-drain loops, oversized inputs, wallet exhaustion, denial of wallet, or model-extraction by mass querying. | Oversized-input detection, a content-free usage / cost signal (call volume + rough spend), and machine-speed burst / loop detection via the autonomous-agent-behavior signature. Hard rate-limits and budget caps require sitting in the traffic path (a gateway) — MoorAI detects and flags runaway consumption, it doesn't cap it. |
Coverage reflects MoorAI's on-device detectors and the console posture scorecard, mapped to the OWASP LLM Top 10 (2025). Content-free by default — category, risk level, and a keyed one-way hash, never prompt or file content; the one exception is an opt-in capture tier an administrator can turn on explicitly, which does store the matched text. This supports your governance and audit work; it is not a certification. OWASP® is a trademark of the OWASP Foundation.