JFrog Closes the Shadow AI Blind Spot: Unveils AI-SEC to Control Every AI Agent, Skill, and Model, from Developer to Production

New Local Shadow AI Detection and Bring Your Own LLM Key scanning give security teams oversight of AI assets that pipeline and registry controls never reach

SUNNYVALE, Calif. & BARCELONA, Spain, October 21, 2026--swampUP Europe 2026 – JFrog Ltd. (Nasdaq: FROG), the Liquid Software company and creators of the JFrog Software Supply Chain Platform, the system of record for trusted software artifacts, binaries, and AI assets, today announced advancements in JFrog AI Security, bringing AI asset detection, scanning and policy enforcement together in a single solution for the AI-Driven Software Supply Chain. JFrog is building upon its current Shadow AI Detection capabilities, extending to the developer endpoint. Local Shadow AI Detection surfaces AI assets running directly on developer machines, where pipeline and registry controls don't reach. JFrog is also introducing New AI Asset Scanning with Bring Your Own LLM Key (BYOK), which lets customers scan skills, coding agent plugins, and APM packages using their own LLM instance, so they can vet this layer of the AI supply chain on infrastructure they control.

"Developers are already running AI agents organizations can't see. JFrog AI Security brings them under control," said Shlomi Ben Haim, Co-Founder and CEO, JFrog. "Until now, the conversation around AI agents has focused on what they can build vs. what they can break or who answers for it when that happens. The question is no longer whether agents will touch your supply chain – it's whether you can prove what they touched. Our customers live in a zero-trust world and can't trust AI agents or developers using AI blindly. JFrog brings detection, scanning, and policy enforcement for the AI-powered software supply chain into one solution."

Attackers Moved from Code to Instructions

The JFrog 2026 Software Supply Chain Security State of the Union report tracked malicious AI agent skills, identifying 969 carrying high-impact payloads, alongside 495 malicious AI models on Hugging Face. Existing AppSec tools were built to catch vulnerable code. Agent skills, plugins, and APM packages ship something different: plain-English instructions that an agent reads and acts on.

JFrog's AI Security bridges that gap with three capabilities: Local Shadow AI Detection, which inventories the AI assets in use; AI Asset Scanning, which reads the intent of models, skills, plugins, and APM packages; and JFrog Agent Guard, which enforces policy at the point an agent reaches for any of them. Together, they give security and developer teams a single source of truth for AI assets.