JFrog Ltd. (Nasdaq: FROG) announced new capabilities within its AI Security product at its swampUP Europe 2026 conference, adding Local Shadow AI Detection and AI Asset Scanning with Bring Your Own LLM Key (BYOK) to its software supply chain platform.

Local Shadow AI Detection extends JFrog's existing shadow AI capabilities to developer workstations, identifying AI assets such as skills, plugins, and MCP servers installed through channels including Git, Slack, marketplaces, and zip files. The feature is deployed via the JFrog Agent Plugin through mobile device management or agent harness settings. Scanning runs on the local device, with only metadata and a risk assessment sent back to the JFrog Platform.

The BYOK scanning feature allows customers to scan AI agent skills, coding agent plugins, and agent package manager packages using their own private LLM account. Prompts and skills are routed directly from the JFrog Platform to the customer's model endpoint. For self-hosted JFrog customers, BYOK is described as the only available method to run AI Asset Scanning. The initial release supports Anthropic's Opus 4.8, OpenAI's GPT 5.6 Sol, and Google's Gemini 3.1 Pro.

According to JFrog's 2026 Software Supply Chain Security State of the Union report, researchers identified 969 AI agent skills carrying high-impact payloads and 495 malicious AI models on Hugging Face.

"Security teams need visibility that starts at the developer's machine – before an asset ever reaches a coding agent or is shared through Artifactory," said Yuval Fernbach, Vice President and CTO of JFrog AI Security.

JFrog AI Security, including both new features, is available to JFrog Unified Security and Ultimate Security customers.