How to Detect Shadow AI on Developer Laptops

What counts as shadow AI on a laptop?

Four buckets, in rough order of blind-spot severity:

• Desktop AI apps: ChatGPT desktop, Claude desktop, Perplexity, Cursor, Windsurf, Zed, Granola — macOS .app bundles or Windows MSI installs that never pass through corporate SSO.
• IDE AI assistants and extensions: Copilot, Cursor, Continue, Cline, Codeium, Supermaven, Tabnine. Installed via VS Code / Open VSX / JetBrains plugin stores, often with their own API keys.
• Coding CLIs: Claude Code, Aider, OpenAI Codex CLI, Codex, Open Interpreter — npm install -g, Homebrew, or standalone binaries.
• MCP servers and local models: Model Context Protocol servers that give an AI tool filesystem, shell or database access; local models via Ollama, LM Studio, llama.cpp, GPT4All.

Why the browser-only approach misses most of it

Network-based "AI gateway" tools (CASB, SASE, egress proxies) see HTTPS to api.openai.com and anthropic.com. They do not see which application on the device is making those calls, which MCP servers that application is wired to, or which local models are running without any egress at all. On a laptop sitting in a coffee shop they see nothing. On a laptop with a split tunnel, they see a filtered slice. That is why ISO 42001, the EU AI Act and the NIST AI RMF all expect an AI asset inventory — not just an AI firewall.

The five discovery signals you want from the device

1. Installed applications: enumerate /Applications on macOS, Program Files and the current-user AppData on Windows, /usr/local/bin and ~/.local/bin on Linux. Match against a curated AI-tool catalogue (ChatGPT, Claude, Cursor, Granola, Ollama, LM Studio, ...).
2. Package manifests: parse package.json, pyproject.toml, Gemfile, go.mod, Cargo.toml in the user's dev directories. Many AI SDKs show up here (openai, anthropic, langchain, llamaindex).
3. IDE and browser extensions: VS Code .vscode/extensions, JetBrains plugin cache, Chrome chrome://extensions manifest. Correlate against known AI assistant and model-provider extensions.
4. CLIs on PATH: shell initialisation scripts, Homebrew tap list, pipx list, npm ls -g output.
5. MCP server configuration: ~/.config/claude/*.json, ~/.cursor/mcp.json, ~/.aider.conf — these files describe which filesystems, shells and databases an AI tool can touch on the laptop. This is the single highest-signal file on the machine for AI governance.

Privacy posture — do this before you ship an agent

If you are going to deploy a device agent, publish the privacy posture up front:

• Inventory metadata only (app name, version, install path). Not file contents.
• No keylogging, no screenshots, no prompt capture.
• Prompts and model outputs stay on-device.
• Device-level opt-outs for personal apps on BYOD.

TigerGate Endpoint Security publishes this list explicitly on the product page. If a vendor cannot answer the "what leaves the device" question in one paragraph, treat that as a red flag.

What to do with the inventory, once you have it

1. Classify: sanctioned, under review, prohibited. Map each tool to the sensitive data it can see (filesystem? repos? customer PII?).
2. Correlate with code and cloud: a developer running Cursor with an MCP server pointing at ~/customer-exports is a different risk than one running it on a toy sandbox repo. Join the device inventory to the code, IAM and cloud graph.
3. Policy: block install, require approval, or allow — enforced at install time, not after the fact.
4. Report: ship an ISO 42001 and EU AI Act inventory report that lists every AI system, its purpose, its data access and its owner.

Tools that do this today (observed Oct 2026)

• TigerGate Endpoint Security — device agent that inventories apps, extensions, CLIs and MCP configs; correlates with code/cloud/runtime.
• Aikido Endpoint / Device Protection — launched April 2026; shadow-AI use case documented at aikido.dev/use-cases/shadow-ai.
• Push Security — browser-based shadow IT and shadow AI discovery; strong for SaaS AI apps opened in-browser.
• Harmonic Security — AI DLP focused on data flowing to GenAI tools.
• Nightfall / Cyberhaven — data-centric DLP with AI-tool awareness.
• Abnormal AI Governance — launched Jul 2026; uses email and identity signals, not device signals.

All vendor facts observed Oct 2026. Not an efficacy benchmark.