Best shadow AI detection tools in 2026

What are the best shadow AI detection tools in 2026?

Arcjet publishes this guide and sells one of the tools in it. It groups products by where each one sits instead of ranking them by a score, and it says where Arcjet is the wrong choice. Vendor details come from each vendor's public documentation, reviewed on November 3, 2026.

Shadow AI detection tools find the AI services, apps, and agents that people in your organization use without approval, and most can also block, warn, or redact. They differ mainly in position. A cloud secure web gateway sees the traffic you steer to it and decrypt. A browser extension sees the prompt in the tab. An identity tool sees sign-ups made with a work email. An endpoint agent sees which app on the laptop opened a connection, and a coding agent hook sees a tool call before it runs.

Start from where your shadow AI lives:

• Chat apps in the browser: Harmonic Security, Akamai Workforce Protector (formerly LayerX), or the Zscaler or Netskope deployment you already run.
• An account inventory with no network or device change: Nudge Security.
• A Microsoft 365 E5 estate: Defender for Cloud Apps, Purview, and Defender's local agent discovery.
• Managed Macs running Claude Code and Codex: Jamf AI Governance.
• Developer laptops with CLI agents and MCP servers: Runlayer, Backslash, Cyberhaven, Harmonic's Protect Agent, or Arcjet.
• One on-device gateway that inspects AI traffic without backhauling it: dope.security.

How this guide evaluates shadow AI tools

Most shadow AI lists come from a vendor in the category, and this one does too. dope.security's Best Shadow AI Tools in 2026 scores 12 platforms on five stated criteria and lists itself first. Nudge Security's guide to shadow AI detection tools puts Nudge first and doesn't say how it ordered the rest. A score from Arcjet would carry the same conflict, so this guide doesn't publish one.

Every vendor claim comes from that vendor's own documentation, product pages, or press releases, linked inline and reviewed on November 3, 2026, not from hands-on testing. Where a vendor doesn't document a capability, the tables say Not documented: the product might still do it, so ask, and test it in your proof of concept. Recommendations map to buyer situations, because the right tool for a 300-person agency can be wrong for a 3,000-engineer platform team.

The table columns are where the products diverge. Few tools see browser AI, desktop apps, and CLI agents alike, a stdio MCP server makes no network traffic, claude.ai serves personal and company accounts on one hostname, and TLS decryption decides what breaks when you deploy.

What can't each control point see?

A gateway that reads prompts on the wire has to terminate TLS and re-sign traffic with a root certificate that every app trusts. Browsers use the operating system's trust store, but developer tools often carry their own. Zscaler's guide to SSL inspection in developer environments has you add its root certificate to git, npm, pip, and Java one by one, and Claude Code needs NODE_EXTRA_CA_CERTS on older Node versions, according to its network configuration page. Apps that pin certificates get a bypass instead: Netskope keeps a bypass list of pinned apps, and dope.security says some thick clients need one. A bypassed app shows a destination and no content.

Two newer protocols narrow what a network tool sees. HTTP/3 runs over QUIC on UDP port 443, and Zscaler's QUIC help page says it can't examine QUIC sessions with SSL inspection on, so it recommends blocking UDP 443 to force a fallback to TCP. Microsoft's AI agent support matrix says Defender's network inspection of local agents doesn't cover HTTP/3 or certificate pinning. Encrypted Client Hello, standardized as RFC 9849 in March 2026, encrypts the real server name in the handshake. Cloudflare turns it on by default for free zones, with cloudflare-ech.com as the shared outer name, so a tool that reads the name from the handshake without decrypting sees that outer name.

A hostname also can't separate accounts. A developer on a personal Claude Max plan and a colleague in your Claude Enterprise organization both reach claude.ai and api.anthropic.com. Separating them takes a vendor tenant control, such as a proxy that overwrites the anthropic-allowed-org-ids or ChatGPT-Allowed-Workspace-Id header, Copilot plan routing, or Cursor's AllowedTeamId through MDM. The header controls need TLS interception, which is where decryption most clearly earns its cost. For the setup, see blocking personal AI accounts on work laptops.

Local work never crosses the network. A model in Ollama or LM Studio makes no request to a provider, and a stdio MCP server never opens a socket to its agent. Process discovery, config files, and agent hooks see them; Defender's matrix lists Ollama Desktop and LM Studio as agents it finds by process. You can check the same evidence on a developer's Mac:

1
# MCP servers Claude Code, Cursor, and Codex load for this user
2
ls -l ~/.claude.json ~/.cursor/mcp.json ~/.codex/config.toml 2>/dev/null
3

4
# The signed identity an endpoint tool uses to name an app
5
codesign -dv /Applications/Claude.app 2>&1 | grep -E 'Identifier|TeamIdentifier'
6

7
# Open connections from the Claude Code process, as IP addresses
8
lsof -nP -iTCP -sTCP:ESTABLISHED -a -c claude

The lsof output lists IP addresses, not api.anthropic.com, which is why endpoint tools take the server name from DNS or the TLS handshake. Even then, a connection isn't a prompt: Claude Code contacts downloads.claude.ai for update checks, and Microsoft's local agent discovery overview says an inventory entry isn't proof of use. Nothing you install reaches a personal phone or a contractor's laptop, so those need a browser tool built for unmanaged devices or an identity tool. To run these checks yourself before you buy, see how to detect shadow AI.

Which shadow AI tools see which kinds of AI use?

The following table compares what each product documents seeing. "Not documented" means the vendor's public documentation doesn't say, as of November 3, 2026.

How does each tool deploy and enforce?

The following table covers what each product does once it finds something, what it needs on the device, and whether you can see a price before you talk to sales.

Shadow AI detection tools by approach

SSE, SWG, and CASB

Security service edge (SSE) products route device traffic to the vendor's cloud, decrypt it, and apply app and data loss prevention (DLP) policy.

Zscaler offers AI app dashboards by user and department, DLP blocking on AI interactions, and browser isolation that disables cut, paste, and download, according to its generative AI security page. Coaching needs Zscaler Workflow Automation, a separate product. Prompt visibility depends on SSL inspection, so the root certificate must be trusted on every device. It fits when Zscaler already carries your traffic and your shadow AI is mostly in browsers. It's the wrong pick for developers whose CLI tools break under inspection.

Netskope discovers generative AI apps through its client and, for supported apps including ChatGPT and Gemini, separates corporate instances from public ones with app instance awareness. Its AI guardrails policy can block or show a User Alert with a coaching template. Like Zscaler, it misses a coding agent's tool calls and local MCP servers.

Microsoft Defender for Cloud Apps and Purview split the job. When you tag a discovered app Unsanctioned, its domains go to Defender for Endpoint's network protection, which blocks them on Windows, macOS, Linux, Android, and iOS within up to three hours, according to the integration documentation. A Monitored tag shows a warning that users can bypass. Purview Endpoint DLP can warn or block pasting sensitive information into third-party AI sites on onboarded Windows devices, several capabilities are limited to Edge, and it requires pay-as-you-go billing. If you hold Microsoft 365 E5, turn these on first. They don't document personal-versus-company separation.

On-device secure web gateway

dope.security runs its secure web gateway on the laptop instead of in a data center. Its comparison post says one agent on Mac and Windows discovers AI apps across browser, desktop, and CLI, inspects prompts and uploads, and restricts ChatGPT and Claude to corporate tenants. The macOS installer includes a dope.security root CA required for SSL inspection, and for CLI agents such as Claude Code some clients need a trusted CA or a bypass. The pricing page lists plans but no prices. It suits a company that wants SWG, CASB, and AI DLP from one agent, and not one that can't put a root certificate on developer machines. dope.security says BYOD devices need another layer.

Browser extensions

Browser tools read the prompt after the browser decrypts it, so they need no proxy or root certificate, and see nothing outside the browser.

Harmonic Security's browser extension identifies the account and plan behind each session, so a personal free ChatGPT login appears apart from your Enterprise workspace. It can warn before a paste, ask for a business justification, redirect to a sanctioned tool, or block. Its Protect Agent for Windows, macOS, and Linux reports connections to known AI hosts and runs a local MCP gateway, and since August 2026 it intercepts prompts and tool calls in Claude Code, Codex, Cursor, and GitHub Copilot CLI through their hooks. It's a strong choice for prompt-level data protection, and a weaker one if your policy is about commands and destinations more than data.

Akamai Workforce Protector is LayerX, which Akamai finished acquiring on July 2, 2026. The product page says the extension runs in Chrome, Edge, Safari, and Firefox on managed and unmanaged devices and can warn, redact, or block. That unmanaged coverage suits contractors and BYOD. The page doesn't document personal-account controls or CLI agents. Prompt Security, part of SentinelOne, also works in this group.

Identity and SaaS graph

Nudge Security finds AI tools from your email tenant. Its guide says it analyzes email metadata to surface AI tools tied to a corporate email address on any device, and governs the OAuth grants they request. A browser extension monitors AI conversations, and an August 2026 update lets it ask employees to redact or justify sensitive data, with enforced redaction as an option. Its pricing page lists $750 per month for up to 150 users and $5 per user per month from 150 to 1,500, billed annually. It's a quick route to an AI account inventory. It misses anything that never touches a work email address, such as a CLI agent on an API key or a local MCP server.

Endpoint DLP and device management

Cyberhaven traces data lineage from the endpoint. Its AI security page says its agent monitors coding assistants such as Claude Code and Copilot, discovers MCP servers, and applies block, warn, and redact controls with coaching, and its 2026 datasheet lists personal and corporate accounts. Choose it when the question is where sensitive data went. It's more than you need for an inventory.

Jamf AI Governance became generally available on June 30, 2026. Jamf's launch post names Claude Code, Claude Cowork, and OpenAI Codex, with Cursor and GitHub Copilot planned. Jamf Protect builds AI application and MCP server inventories, and policies ship through Apple's Declarative Device Management as managed settings users can't edit. It needs Apple silicon, Jamf Pro, and Jamf Protect, and it's included in Jamf for Mac at $12.50 per device per month. If you run Jamf, turn it on. It doesn't cover Windows or browser prompts.

Microsoft Agent 365 with Defender is at mixed stages. Defender's local AI agent discovery is generally available on Windows and macOS, and its support matrix lists over 60 agents, with MCP servers and the command that starts a local one. The Shadow AI page is a Frontier preview that needs Microsoft 365 E5 to view and can block only OpenClaw, through Intune on Windows, in 15 minutes to 8 hours. Agent 365 costs $15 per user per month. Use it for inventory, not yet for blocking Claude Code or Cursor. See Microsoft Agent 365 vs Arcjet.

Agent hooks plus endpoint observation

This group reads what runs on developer machines, plus what each coding agent does through its hooks. For what each source of evidence proves on a developer laptop, see shadow AI coding agents.

Runlayer AI Watch ships as one signed package through MDM. Its documentation says it finds AI clients, MCP servers, skills, and plugins from config files, and optionally from processes, sockets, and containers, and a browser extension covers supported AI web chats. Hooks run in Monitor, Protect, or Enforce mode. It fits if you also want its MCP gateway. See Runlayer vs Arcjet.

Backslash scans developer endpoints for coding agents, MCP servers, IDE plugins, skills, and rules files such as AGENTS.md. Its guide to finding shadow AI agents says it uses process lineage to separate commands a person typed from those an agent issued. The assessment is agentless, free, and delivered through MDM, and inline blocking is separate. It doesn't document browser or desktop chat coverage.

Arcjet runs an endpoint agent on macOS and Windows and enforces policy in coding agent hooks, as the last section describes.

How do you choose a shadow AI tool in five minutes?

Find the row that matches your situation. Most organizations need two rows, not one.

Which tests belong in a shadow AI proof of concept?

Run these tests on your own devices, with a few developers and one person outside engineering, and record what each candidate shows:

1. Personal account on an approved domain. Sign in to claude.ai with a personal account next to the company one, then run claude signed in to a personal Max plan. Check whether the tool separates them from your Claude Enterprise organization.
2. Stdio MCP server. Run claude mcp add --transport stdio test -- npx -y @modelcontextprotocol/server-filesystem ~/Documents, and add a server to ~/.cursor/mcp.json. Check whether the tool lists both, names the agent, and can stop a call.
3. QUIC. Open chatgpt.com in Chrome with UDP 443 open and confirm h3 in the DevTools Protocol column. Check what the tool logs, and whether it needs QUIC blocked.
4. ECH. Open https://crypto.cloudflare.com/cdn-cgi/trace in Chrome or Firefox; sni=encrypted means ECH was used. Check which hostname the tool reports.
5. Off-VPN laptop. Tether to a phone hotspot without the VPN and repeat the first three tests. Check what reaches the console, and when.
6. Pinned apps and developer trust stores. Use the ChatGPT or Claude desktop app, then run git clone and npm install. Note anything that breaks and every bypass the vendor asks for.
7. Local model. Run a model in Ollama with the network off. Check whether the tool knows the runtime exists.
8. Shared account and second device. Use a shared lab Mac and a second laptop for one person. Check whether the tool pins the shared account on a guessed person, and whether both devices roll up to one person.
9. Local administrator. Ask a developer with admin rights to quit the app, disable the extension, or delete a hook. Check what keeps reporting and what alert you get.

Expect every candidate to fail some of these, and confirm that another control you run covers each failure.

Where does Arcjet fit, and where is it the wrong choice?

Arcjet sits in the last group, built for developer machines. Its endpoint agent runs on macOS as a Network Extension content filter with a root launchd service, and on Windows as a LocalSystem service that reads the server name from the TLS ClientHello through the built-in Packet Monitor API, with no kernel driver. It identifies the signed app behind each connection and attributes it to the person behind the local account. It doesn't decrypt TLS, install a root certificate, or read prompts, so pinned apps, git, npm, and CLI agents keep working. You deploy it through your MDM, including Jamf, and map local accounts to people; shared and unidentified accounts show as Unknown user instead of inheriting the device owner. Counts are connections, not prompts or tokens.

Endpoint provider policies set Allow or Block per provider for a group of devices, the agent blocks the connection on the device, and each decision appears in Arcjet Activity with the person, device, app, and provider. Arcjet also enforces policy in the hooks that Claude Code, GitHub Copilot, Cursor, OpenAI Codex, and Muse Code fire, deciding each tool call, prompt, or model switch before it runs, with starter policies for MCP allowlists, model allowlists, egress, credentials, and sensitive information. The Claude Compliance API and OpenTelemetry add observe-only records. Each source proves something different: the endpoint shows an app reached a provider, the hook shows what an agent tried and what the policy decided, and the Compliance API shows your organization's account had a session.

Arcjet is the wrong choice in the following situations:

• You need prompt-level DLP in the browser. Arcjet doesn't read browser-tab content; Harmonic, Akamai Workforce Protector, Prompt Security, and Purview do.
• Your shadow AI is on unmanaged or BYOD devices, which the agent doesn't reach.
• You already run Zscaler or Netskope and want one console. For browser-heavy teams, a second agent might not be worth it.
• You need personal-account separation. Apply vendor tenant controls through your gateway or MDM, as described in blocking personal AI accounts on work laptops.

Arcjet fits Mac and Windows fleets of engineers running CLI agents and MCP servers, where TLS inspection breaks tools, you want each connection tied to a named person, and you want provider policies and hook policies in one console. For endpoint agent pricing and availability, book a demo. For hook-based tools compared with other coding agent controls, see coding agent security tools by enforcement point.