Securing the AI Supply Chain: JFrog Targets Shadow AI at the Endpoint

SUNNYVALE, Calif. & BARCELONA, Spain – October 21, 2026 – The enterprise software supply chain is undergoing a radical transformation, and with it, the attack surface has fundamentally shifted. For years, application security teams have focused on identifying vulnerable code syntax and unpatched dependencies. Today, the most insidious threats do not look like traditional malware; they look like plain-English instructions.

At the swampUP Europe 2026 conference, JFrog Ltd. (Nasdaq: FROG) unveiled significant advancements to its AI Security suite designed to address this exact paradigm shift. By introducing Local Shadow AI Detection and AI Asset Scanning with Bring Your Own LLM Key (BYOK) capabilities, the company is extending its security perimeter directly to the developer workstation. The move signals a critical pivot in DevSecOps: acknowledging that before AI agents can build the future of software, organizations must prove they can control the tools those agents use.

The Rise of Natural Language Malware

The integration of "Agentic AI" into development workflows has created unprecedented productivity gains, but it has also introduced a novel class of vulnerabilities. Unlike early generative AI assistants that merely suggested code snippets, modern autonomous agents can reason, plan, and execute multi-step processes. They can access file systems, query databases, and interact with external APIs. This autonomy requires specialized extensions—often called skills, plugins, or Model Context Protocol (MCP) servers—which have become the new frontier for threat actors.

According to the JFrog 2026 Software Supply Chain Security State of the Union report, researchers identified 969 malicious AI agent skills carrying high-impact payloads, alongside 495 malicious AI models hosted on the popular repository Hugging Face. These numbers highlight a growing trend where attackers are moving away from brute-forcing infrastructure and instead focusing on "tool poisoning."

In a tool poisoning attack, adversaries embed malicious instructions within a tool's metadata, parameter descriptions, or schemas. When an AI agent loads this information, it treats the injected text as legitimate operational guidance. Because these skills are essentially lightweight, open-format extensions, a compromised skill can silently instruct an agent to exfiltrate AWS credentials, read local environment files, or execute unauthorized code.

"Developers are already running AI agents organizations can’t see. JFrog AI Security brings them under control," said Shlomi Ben Haim, Co-Founder and CEO of JFrog. "Until now, the conversation around AI agents has focused on what they can build vs. what they can break or who answers for it when that happens. The question is no longer whether agents will touch your supply chain – it’s whether you can prove what they touched."

Illuminating Shadow AI on Developer Workstations

The rapid, often decentralized adoption of AI tools has given rise to "Shadow AI"—the deployment of unsanctioned AI assets within an enterprise. Developers routinely install skills, MCP servers, and hooks through Git repositories, Slack channels, or third-party marketplaces to accelerate their workflows. Because these assets run locally with the developer’s own permissions and credentials, they bypass traditional pipeline and registry security controls.

To combat this blind spot, JFrog’s new Local Shadow AI Detection deploys directly onto developer machines via mobile device management (MDM) or agent harness settings. The system is designed to inventory AI assets the moment they land on a workstation, regardless of their origin.

Crucially, this endpoint visibility is engineered to balance security with developer privacy and system performance. The local agent performs deterministic scanning directly on the local device. Rather than transmitting source code, proprietary prompts, or sensitive local data back to a central server, the scanner only sends metadata and a risk assessment back to the central platform. Every detected asset is then cross-referenced against approved source data, allowing platform engineering and security teams to establish a baseline of acceptable use without imposing heavy processing overhead on the developer's machine.

One DevSecOps director at a major financial institution noted the urgency of this visibility. "Our biggest fear isn't a vulnerability in our production code; it's a developer downloading a highly rated, yet compromised, AI plugin that silently harvests API keys during local testing. If we can't see what the agent is doing on the laptop, we have already lost the battle before the code even reaches a pull request."

BYOK: Balancing Automated Security with Data Sovereignty

As organizations race to secure their AI supply chains, they face a secondary, equally complex challenge: data sovereignty. Advanced semantic scanning is required to read and assess the intent of plain-English models, skills, and APM packages. However, highly regulated industries—such as finance, healthcare, and defense—are strictly prohibited from routing proprietary code or sensitive AI instructions through third-party, vendor-hosted security gateways.

JFrog's introduction of AI Asset Scanning with Bring Your Own LLM Key (BYOK) directly addresses this enterprise friction. The BYOK capability allows customers to perform deep semantic scanning using their own private LLM accounts. Prompts and skills are routed directly from the customer's platform instance to their designated model endpoint.

This zero-data retention architecture ensures that external vendors do not process or store the customer's proprietary data. Furthermore, it allows enterprises to leverage their existing enterprise-grade API agreements with major LLM providers. These enterprise contracts typically include robust privacy guarantees, ensuring that submitted data is not used for future model training and is encrypted both in transit and at rest.

"Security teams need visibility that starts at the developer’s machine – before an asset ever reaches a coding agent or is shared through Artifactory. Regulated customers need scanning that points at their own models," said Yuval Fernbach, Vice President & CTO, JFrog AI Security. "Local Shadow AI Detection and AI Asset Scanner address both needs in a single solution."

Initial releases of the BYOK scanning feature support top-tier enterprise models, including Anthropic's Opus 4.8, OpenAI's GPT 5.6 Sol, and Google’s Gemini 3.1 Pro. For self-hosted customer bases, BYOK serves as the exclusive method for running AI Asset Scanning, preserving the air-gapped or highly controlled nature of their infrastructure.

Navigating the Future of AI Governance

The introduction of these capabilities places JFrog in a unique position within the broader cybersecurity landscape. While competitors like Snyk, Palo Alto Networks, and GitHub Advanced Security are rapidly evolving their platforms to address AI vulnerabilities, much of the industry's focus has remained on cloud infrastructure, CI/CD pipelines, or securing the AI models themselves in production.

By shifting the focus entirely left to the developer endpoint, the new suite targets the earliest possible stage of the AI software supply chain. This approach addresses what industry analysts have dubbed the "illusion of mastery" in enterprise AI governance. Recent surveys indicate that while the vast majority of organizations claim to have certified AI model governance frameworks in place, nearly one in five actively allow developers to pull unvetted models from public registries.

The threat landscape is expanding far beyond traditional Common Vulnerabilities and Exposures (CVEs). Because AI agent risks often stem from insecure defaults, prompt injection vulnerabilities, and malicious tool composition, traditional static and dynamic application security testing tools are frequently blind to these new vectors. An attacker does not need to exploit a buffer overflow if they can simply instruct an authorized AI agent to hand over the keys to the kingdom.

As AI continues to redefine how software is built, the definition of the software supply chain must expand to include every model, skill, plugin, and MCP server. By providing a single system of record that spans from the developer's laptop to the production environment, organizations are finally gaining the tools necessary to trust the autonomous agents writing the next generation of enterprise software.