JFrog extends shadow AI detection to developer workstations
JFrog AI Security now detects AI assets on developer machines and scans agent skills and plugins using the customer's own LLM key.
By GennnAi··1 min read
Announced at swampUP Europe, Local Shadow AI Detection finds skills, plugins and MCP servers installed outside security review; scanning runs locally and only metadata and a risk assessment go back to the platform. BYOK scanning sends prompts directly to the customer's model endpoint, not through a JFrog-hosted gateway. JFrog's report counted 969 malicious agent skills with high-impact payloads and 495 malicious models on Hugging Face. It is available now.
Source: JFrog, published on October 21, 2026.