JFrog Expands AI Security: Local Shadow AI Scanning and BYOK Support
JFrog extends its AI security scanning to developers' local machines to identify unauthorized AI skills and plugins, introducing BYOK for privacy-preserving semantic analysis.
Software supply chain security company JFrog has announced an expansion of its AI Security suite, extending shadow AI detection from traditional repositories and builds to developers' local computers. The new JFrog Agent Plugin, deployed via Mobile Device Management (MDM) or agent settings on workstations, is designed to discover unauthorized AI Skills, plugins, and MCP servers.
According to JFrog's '2026 Software Supply Chain Report', the company previously identified 969 malicious Agent skills and 495 malicious AI models on platforms like Hugging Face. This update aims to close the regulatory gap before these assets enter production environments. The scanning process executes deterministically locally, sending only metadata and risk assessments back to the JFrog platform, thereby balancing security with privacy.
Another significant update is the introduction of a 'Bring Your Own LLM Key' (BYOK) mechanism for semantic AI asset scanning. This feature allows customers to use their own subscribed model endpoints, such as Anthropic's Claude Opus 4.8, OpenAI's GPT-5.6 Sol, or Google's Gemini 3.1 Pro, for analysis without routing prompts and data through a JFrog gateway. This change makes security reviews of complex AI logic more flexible and compliant with data regulations.