What happened
At swampUP Europe on Oct 21, JFrog announced Local Shadow AI Detection (inventories skills, plugins and MCP servers on developer workstations via the JFrog Agent Plugin) and AI Asset Scanning with Bring Your Own LLM Key for semantic scanning, both available now to Unified/Ultimate Security customers.
Why it matters
It closes the shadow-AI blind spot where developers install agentic assets outside pipeline/registry control — the same attack surface behind the 969 malicious agent skills JFrog tracked — while BYOK keeps regulated customers' prompts on their own models.
Applicability
Platform engineering and security teams on JFrog should enable Local Shadow AI Detection and evaluate BYOK scanning for regulated or self-hosted environments.