JFrog adds AI security controls for developer tools

JFrog has added AI security features designed to detect and govern AI tools that developers use outside existing controls. The update extends the company's shadow AI detection to developer devices and adds AI asset scanning with customer-supplied large language model keys.

The new features are intended to give security teams visibility into AI-related software, including coding agent plugins, skills and model context protocol servers that may be installed locally and used without formal review.

The latest changes combine detection, scanning and policy enforcement in one system, helping organisations track AI assets from developer machines through to production environments.

The announcement follows company research that pointed to a growing security issue around AI components. JFrog said it identified 969 malicious AI agent skills carrying what it described as high-impact payloads, along with 495 malicious AI models on Hugging Face.

Those findings reflect a shift in how threats can enter software environments. Rather than relying only on harmful code, attackers can also use plain-language instructions embedded in agent skills, plugins and related packages that AI agents then read and act on.

Developer visibility

A central part of the update is local shadow AI detection on developer endpoints. The feature is designed to identify AI assets when they are installed on individual machines, including tools obtained through code repositories, marketplaces, messaging platforms or compressed files.

JFrog said the software can detect skills, plugins and MCP servers as they arrive on a workstation. Scanning runs on the local device, with only metadata and a risk assessment sent back to the JFrog platform.

The system also cross-references discovered assets against information in the platform to determine whether they match approved tools. This is intended to give security teams a baseline for enforcement and governance.

Developers have increasingly adopted AI assistants and agent-based tools in day-to-day work, often outside formal procurement or security review. That has created a challenge for companies trying to understand which tools are in use, who introduced them and whether they meet internal compliance standards.

"Developers are already running AI agents organizations can't see. JFrog AI Security brings them under control," said Shlomi Ben Haim, Co-Founder and Chief Executive Officer, JFrog.

"Until now, the conversation around AI agents has focused on what they can build vs. what they can break or who answers for it when that happens. The question is no longer whether agents will touch your supply chain - it's whether you can prove what they touched. Our customers live in a zero-trust world and can't trust AI agents or developers using AI blindly. JFrog brings detection, scanning, and policy enforcement for the AI-powered software supply chain into one solution," said Ben Haim.

Customer keys

The second addition is AI asset scanning with Bring Your Own LLM Key, or BYOK. This lets customers use their own large language model accounts and infrastructure to scan AI assets, rather than routing prompts and scans through a JFrog-hosted model service.

The approach is likely to appeal to regulated businesses and self-hosted customers that want tighter control over data flows. JFrog said prompts and skills go directly from its platform to the customer's own model endpoint.

Using a customer's own model key also means scanning charges are billed through that provider relationship. BYOK is the only option for self-hosted customers running AI asset scanning, JFrog said.

Initial support covers Anthropic's Opus 4.8, OpenAI's GPT 5.6 Sol and Google's Gemini 3.1 Pro.

Policy controls

Alongside detection and scanning, JFrog is positioning policy enforcement as the third part of the offering. This allows organisations to set approved baselines for models, skills, plugins and agents, then govern those assets from a single system of record.

That matters because many existing application security tools were built to inspect software code and known package dependencies, not AI instructions written in natural language. As AI agents become more embedded in software development, security vendors are adapting tools to identify risk in assets that do not look like conventional code.

JFrog said its Agent Guard product enforces policy when an agent attempts to use one of these assets. Combined with endpoint detection and scanning, the aim is to give security and platform engineering teams a consolidated view of which AI tools are being used and whether they meet policy standards.

"Security teams need visibility that starts at the developer's machine - before an asset ever reaches a coding agent or shared through Artifactory. Regulated customers need scanning that points at their own models," said Yuval Fernbach, Vice President & Chief Technology Officer, JFrog AI Security.

"Local Shadow AI Detection and AI Asset Scanner address both needs in a single solution: JFrog AI Security," said Fernbach.