Full Report
A user opens a browser tab, pastes data into a chat assistant, and nothing is installed. A developer adds a coding assistant as an editor extension, and nothing shows up in the installed programs list. Someone downloads a local model runtime, a program that runs models directly on the machine instead of sending data to an external service, because they were told not to send company data
Analysis Summary
# Tool/Technique: Shadow AI & AI Agent Frameworks
## Overview
This technique involves the unauthorized or unmanaged deployment of Artificial Intelligence (AI) tools within an enterprise environment. It encompasses browser-based chat assistants, IDE-integrated coding assistants, local model runtimes, and Model Context Protocol (MCP) servers. The primary risk involves "Shadow AI," where tools operate outside the view of traditional software inventories, potentially exposing sensitive source code, credentials, and internal APIs to external models or unauthorized local processes.
## Technical Details
- **Type**: Technique (Shadow IT / Data Exfiltration Risk) / Tool (AI Agents & Frameworks)
- **Platform**: Windows (Primary target for monitoring), Web Browsers, Development Environments (IDEs)
- **Capabilities**:
- **Local Execution**: Running Large Language Models (LLMs) locally to bypass network-based DLP.
- **Plugin/Skill Extension**: Using "Skills" or modular code packages (70,000+ variants) to extend agent capabilities.
- **System Integration**: Connecting to databases, code repositories, and internal APIs via MCP servers.
- **First Seen**: Broad adoption surged circa 2023-2024; monitored context dated October 2026.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- **[T1133 - External Remote Services]**: Use of AI-integrated browser extensions to tunnel data.
- **[TA0007 - Discovery]**
- **[T1082 - System Information Discovery]**: AI agents scanning local environments for context.
- **[TA0010 - Exfiltration]**
- **[T1567 - Exfiltration Over Web Service]**: Pasting sensitive data into LLM chat interfaces.
- **[T1048 - Exfiltration Over Alternative Protocol]**: Local models sending processed data to third-party APIs via non-standard configurations.
- **[TA0009 - Collection]**
- **[T1530 - Data from Cloud Storage]**: AI coding assistants accessing cloud-linked repositories.
## Functionality
### Core Capabilities
- **Chat Interface**: Browser-based interaction with remote LLMs (e.g., ChatGPT, Claude).
- **IDE Integration**: Direct access to source code for autocomplete and refactoring (e.g., GitHub Copilot, Cursor).
- **Local Runtimes**: Programs like Ollama or LM Studio that run models directly on hardware to circumvent "external data" policies.
### Advanced Features
- **Model Context Protocol (MCP)**: Acts as a connector that hands a model access to internal systems (DBs, APIs) often via configuration entries rather than standard installations.
- **Agentic Workflows**: Autonomous agents that can execute "skills" (modular code) to perform tasks across multiple applications.
## Indicators of Compromise
*Note: As these are often legitimate tools used maliciously or unsafely, indicators focus on unauthorized presence.*
- **File Names**: `ollama.exe`, `lms.exe`, various `.vsix` or `.js` files for IDE extensions.
- **Network Indicators**:
- `api[.]openai[.]com`
- `anthropic[.]com`
- `huggingface[.]co`
- (Note: Monitoring for high-volume traffic to model registries).
- **Behavioral Indicators**:
- Browser processes (`chrome.exe`, `msedge.exe`) maintaining long-lived WebSockets to AI domains.
- High GPU/CPU utilization by non-standard/unapproved binaries.
- IDEs accessing configuration files or credential stores outside their typical scope.
## Associated Threat Actors
- **Insider Threats**: Employees bypassing data governance policies to increase productivity.
- **General Attackers**: Leveraging AI agents for automated reconnaissance and rapid code exploit generation.
## Detection Methods
- **Behavioral Detection**: Identifying "Shadow AI" by monitoring for the execution of local model runtimes that do not appear in the official Add/Remove Programs list.
- **Metadata Analysis**: Collecting metadata from endpoint agents to identify unapproved AI browser extensions and IDE plugins.
- **Skill Mapping**: Auditing public registries for "skills" or packages imported by AI agents.
## Mitigation Strategies
- **Visibility & Discovery**: Use specialized tools (like Bitdefender AIVC) to inventory AI assets that bypass standard software inventories.
- **Policy Enforcement**: Move from broad domain blocking to granular functional categories (e.g., blocking "Automation Agents" while allowing "Productivity LLMs").
- **Least Privilege**: Restrict the ability of IDE extensions to access system-wide credentials or non-essential repositories.
- **Local Runtime Governance**: Implement application whitelisting to prevent the execution of unmanaged local LLM runtimes.
## Related Tools/Techniques
- **MCP Servers**: The connective tissue between models and private data.
- **Shadow IT**: The broader category of unauthorized software deployment.
- **Prompt Injection**: A related technique where the AI agent is manipulated into performing unauthorized actions.