JFrog Adds Shadow AI Detection to Security Platform
The company introduced tools to help developers monitor AI assets and agent skills on their local workstations.
Updated on Oct. 21, 2026 in Artificial Intelligence
Live Poll
Do you trust the automated AI plugins and agent software currently running on your own computer?
JFrog has launched new Local Shadow AI Detection and AI Asset Scanning capabilities for its security platform. These tools aim to help enterprises secure AI assets, including plugins and agent skills, directly on developer workstations.
Why it matters
Developers often install AI assets without security oversight, and traditional security tools struggle to interpret the plain-English instructions used by modern AI agent skills. These new features allow security teams to identify and verify AI usage within their environments.
The JFrog 2026 Software Supply Chain Security State of the Union report identified 969 malicious AI agent skills and 495 malicious AI models on Hugging Face. These tools serve 6,600 organizations worldwide.
The players
JFrog
A global software supply chain company based in Sunnyvale, California, known for its DevOps and security automation platforms.
Anthropic
An artificial intelligence safety and research company that produces the Claude model family, including the Opus 4.8 version.
OpenAI
An artificial intelligence research organization that develops large language models including the GPT-5.6 Sol version.
A multinational technology company that develops the Gemini series of large language models, including the 3.1 Pro iteration.
The details
Local Shadow AI Detection deploys via the JFrog Agent Plugin to uncover unauthorized skills, plugins, and MCP servers. AI Asset Scanning utilizes BYOK and semantic scanning to route prompts through a customer's private LLM account for verification.
Timeline
October 21, 2026: JFrog announced the AI security feature advancements.
December 31, 2025: End of JFrog fiscal year for 10-K report.
The Tech Race
This release addresses the rapid proliferation of decentralized AI tools that currently bypass traditional AppSec perimeters. It positions JFrog against competitors by integrating localized, agent-based oversight into the software supply chain.
Developers and security teams can now gain visibility into unauthorized AI plugins and skills running on local machines. These tools streamline the security review process by automating scanning for potential threats within private LLM environments.
The takeaway
Securing AI assets requires moving beyond perimeter defenses to address activity directly on developer workstations. Companies should prioritize deterministic scanning and private model keys to mitigate risks posed by unauthorized agent skills.
Further reading
For broader trends in enterprise AI safety, explore our Artificial Intelligence section.
More information
View the official JFrog AI Security product information to learn about the new capabilities.
Live Poll
Do you trust the automated AI plugins and agent software currently running on your own computer?
