JFrog's AI Asset Detection: Why Shadow AI Is the New Shadow IT

A decade ago, the enterprise security problem was shadow IT: developers spinning up unauthorized cloud services that security teams couldn’t see. The same pattern is repeating with AI — except now the unauthorized assets include models, agent skills, and MCP servers that code without human review.

The Framework

JFrog’s Trusted AI Adoption framework identifies four categories of AI assets that need continuous detection in a modern software supply chain:

Models — AI/ML models pulled from external registries or embedded directly in application containers. A Docker image that ships with a bundled model represents an implicit dependency most artifact scanners don’t flag.

MCP Servers — Model Context Protocol servers that coding agents connect to for extended capabilities. Agents can pull MCP servers from public hubs without authorization, creating a class of external dependency with no registry entry, no version pin, and no security scan. This is the fastest-moving gap in current security tooling.

Agent Skills — Autonomous capabilities agents acquire during operation. Unlike traditional dependencies declared in a manifest, agent skills are often acquired at runtime, making static analysis insufficient.

AI-Generated Code — Code produced by coding agents during development. Generated code introduces the same vulnerability classes as hand-written code, but at higher volume and with different failure modes: agents tend to produce plausible-looking code that passes syntax checks while embedding subtle logic errors.

Detection Approach

Detection runs continuously across four locations:

Binaries and containers: scanning Docker images for embedded models and model dependencies, flagging any image that contains an ML artifact without an approved registry entry.

Source code: static analysis for hardcoded API calls to external LLM services — finding the places where code is calling OpenAI or Anthropic endpoints directly without going through an approved internal proxy.

Build manifests: scanning requirements.txt, package.json, and CI pipeline definitions for external AI dependencies invoked at build time.

Agent configurations: auditing the skills and remote MCP servers that agents are configured to access — the runtime dependency list that no static manifest captures.

Detected assets fall into four states: Managed (registered, versioned, continuously scanned), Partially Managed (approved for some projects only), Unmanaged (unknown, externally sourced — shadow AI), and Malicious (confirmed vulnerability or policy violation). The classification drives enforcement: managed assets proceed; unmanaged assets trigger review; malicious assets block the pipeline.

Where It Doesn’t Apply

The detection framework assumes a centralized artifact management platform (JFrog Artifactory or equivalent) through which dependencies flow. Organizations that allow developers to pull dependencies directly without going through a central registry won’t benefit from this approach — the detection surface isn’t there. The prerequisite is artifact governance infrastructure, not just detection tooling.

Small teams with limited agentic tooling deployment may also find the full framework premature. The value scales with the number of coding agents in active use: one AI coding assistant used carefully by a senior developer is a different risk profile than a fleet of autonomous agents committing code across multiple repositories.

Source: JFrog

Content created with AI assistance and reviewed for accuracy.