JFrog AI Security now detects Shadow AI on developer workstations

Why local AI assets escape security checks

JFrog describes a gap in the traditional software process, in which approved code and tools come from trusted sources, get scanned for vulnerabilities and must pass company security policies. In the "AI-Era", the company says, this process can no longer be relied on for AI assets. Developers and AI tools can introduce unvetted files, scripts and plugins on demand, often from GitHub, Slack threads or even generated by the agent itself.

JFrog lists several examples of such assets:

• Skills: bundles of instructions and scripts that define how an agent performs a task.
• MCP servers: Model Context Protocol servers, the connectors that let agents interact with systems such as databases, Jira or Slack.
• Plugins: installable packages that bundle skills, MCP servers and more.

JFrog singles out Hooks as a clear example of the problem, because authors decide what runs on which machine every time the agent is invoked, without consulting the rest of the team. The company sums this up as two paths: a Managed Path where assets are scanned and vetted, and a Local Path where Shadow AI goes undetected.

From repositories to workstations

Until now, JFrog AI Security detected Shadow AI in the software supply chain by finding AI models in JFrog Artifactory repositories and calls to external AI services in builds. JFrog says that covered the managed path. Shadow AI on local machines is harder to catch, it argues, because third-party code and open-source packages enter through a centralized build process and are not stored locally.

The company says earlier risks on developer machines mostly came from extensions or tools that DevOps fully controlled. Now, malicious or non-compliant AI assets used by coding agents create a risk that arises autonomously, without visibility or control. JFrog says the added protection is meant to work transparently, without affecting developer productivity.

Detection requires installing the JFrog Agent Plugin on each developer workstation. It works in three steps:

• Discover: finds potentially risky skills, MCP servers, plugins, hooks, commands and monitors.
• Scan locally: runs a light, deterministic, rules-based scan on each workstation, designed so the same input gives the same result every time.
• Report: sends metadata, asset identity, findings and risk analysis to the JFrog Platform.

A unified inventory with risk and origin

JFrog AI Security turns the reports into one inventory. Each record shows the asset's name, type, the harness that reported it (such as Claude Code or Cursor), the number of workstations where it was detected, local risk analysis, JFrog origin and a detection timestamp.

Two metrics help prioritize. Risk Assessment shows the findings behind each rating. Examples given are Shell Access plus WebFetch, described as a high risk of data exfiltration, Unscoped Write/Edit, which modifies files outside designated directories, and BypassPermissions Mode, which executes actions without required approval.

Origin shows whether the asset already exists in the JFrog Platform. A match in JFrog Artifactory or JFrog Catalog means it is already managed. "No Match" means it corresponds to nothing managed there.

JFrog also says security teams and platform administrators should learn how risky an asset is, since a skill that can run shell commands carries much greater risk than one that only reads files. A second question is whether policy allows it. A GitHub MCP server may be acceptable if it matches the approved one, but a problem if built from a random repository. The company says it plans to add this policy capability in a future release.

What it means for security teams

For organizations whose developers use coding agents, the update gives security teams a way to see which unvetted AI assets already run on workstations and how severe they are. JFrog's stated aim is for managed and unmanaged AI assets to follow the same rules as every other shipped artifact, with one system of record. The company notes that capabilities vary by edition and deployment model, and it offers a demo of JFrog AI Security.