Shadow AI

​

The Shadow AI Problem

When employees install AI clients, configure MCP servers, or add AI skills directly — Cursor, Claude Code, Claude Desktop, VS Code, Codex, and others — these tools and integrations run outside centralized observability and control. The result is a shadow IT problem for AI tooling: ungoverned access to your code, data, and systems, with no audit trail. Runlayer addresses shadow AI through the AI Watch agent: one signed package with Detect, configurable endpoint behavior, and Sessions telemetry. Deploy it once through your MDM, then change behavior through configuration.

---

​

Security Risks

​

Shadow MCP Servers

Shadow MCP servers pose significant security risks:

• Data exfiltration — Risky MCP servers can steal source code, credentials, API keys, and customer data
• Supply chain attacks — Compromised or trojanized MCP packages can inject risky behavior into otherwise legitimate tools
• Prompt injection — Shadow MCPs may contain tool poisoning attacks that manipulate AI behavior
• Lateral movement — MCPs with broad permissions can be exploited to access internal systems
• Compliance violations — Uncontrolled access to PII, PHI, or regulated data without audit trails

​

Shadow Skills

Skills are instruction files that extend AI coding assistants with specialized knowledge, workflows, and tool integrations — such as SKILL.md files. When these are installed outside organizational control, they become shadow skills. Shadow skills introduce distinct risks:

• Prompt injection — Skill instructions can manipulate AI behavior, override safety guidelines, or inject malicious prompts
• Unauthorized automation — Skills can define workflows that automate actions beyond what an organization has approved
• Supply chain risk — Unvetted community skills may contain instructions that exfiltrate data or introduce vulnerabilities

​

Shadow AI Clients

AI clients are inventory artifacts in their own right. Detect reports supported clients such as Cursor and Claude Code even when they have no MCP servers, skills, or plugins configured, giving security teams visibility into unapproved AI software across their device fleet. New client discoveries start as Shadow. Administrators can mark approved clients as Managed from the Shadow AI Details tab or the Settings → AI client allowlist page. Client presence has a Low baseline risk because presence alone does not expose the behavior of an integration; use the detected version, device, user, and installation evidence when reviewing it.

​

Why This Matters for Security Teams

Unlike traditional shadow IT, shadow AI is particularly dangerous because:

1. AI amplifies access — A single MCP or skill can give AI assistants broad access to databases, APIs, and file systems
2. Actions are automated — MCPs enable AI to take actions autonomously, not just read data
3. No audit trail — Shadow MCPs and skills operate outside your logging and monitoring infrastructure
4. Difficult to detect — MCP configurations and skill files are stored in user-space config files, not installed as traditional software

---

​

One Package, Three Endpoint Modes

Project and client-config detection is always enabled after AI Watch is installed. Before the first successful settings sync, the endpoint starts in Monitor with Sessions and optional runtime discovery disabled, so no hooks are installed. One organization API key authenticates AI Watch scans, hooks, session events, and managed updates; no enrollment keys are required.

• Running-process and container discovery are disabled until the synced settings enable them.
• Monitor is the default mode.
• Sessions and hooks fail closed before settings sync. A successful settings sync or an explicit legacy MDM Sessions=true / Protect / Enforce setting enables them.
• Sessions coverage follows the client surface. Installing the full hook set does not make a client emit events it does not support. Cursor’s classic IDE and Agents Window load the endpoint hook config, while Cursor CLI emits a subset. Cursor Cloud Agents require the separate repository/team hook collector; it is monitor-only and does not inherit endpoint configuration.

Hooks are installed whenever Mode is Protect/Enforce, Sessions is enabled, or Track MCP tool usage without content is enabled; otherwise AI Watch removes stale Runlayer hooks while preserving third-party hooks. On macOS and Windows, admins can change Mode, Sessions, process/container discovery, project depth, and project timeout from Settings → AI Watch → Manage settings. Devices fetch the complete settings snapshot during the privileged hook reconcile, typically within an hour, without an MDM policy update. On macOS with AI Watch 0.29.6 or newer, the same settings page can install or remove the managed Chrome and Firefox extensions and configure their mode and Sessions behavior without an MDM profile update. The tenant host, organization API key, and CPU/memory limits remain MDM-owned. Advanced scan tuning (optional). Detect scans walk each user’s home directory to a bounded depth within a per-scan time budget, and keep CPU and memory use within configurable caps. The defaults fit most fleets — override them only if scans miss deeply-nested project configs (raise depth), run out of time on very large home directories (raise timeout), or you want a smaller footprint on constrained hosts (lower the CPU / memory caps). All are integers. Project depth and timeout are delivered by the Runlayer settings sync on macOS and Windows; native MDM values remain a legacy fallback. CPU and memory caps remain MDM-owned (<integer> on macOS, matching AIWATCH_* MSI properties on Windows). Omit them to keep the defaults. Values outside the range are clamped; non-integer or non-positive values are ignored. The CPU / memory caps are best-effort: the scan is throttled to stay within the configured CPU budget and aborts if it exceeds the memory ceiling. Start with Deploy AI Watch to install the package and choose Mode / Sessions configuration in Runlayer. Detect scans run by default after deployment.

---

​

The Shadow AI page

The Shadow AI page in the sidebar brings every discovery into one view:

• Overview — discovery trends and highlights, including the Shadow vs Managed trend over time
• Activity — a filterable log of AI Watch activity, such as hook events and observed MCP tool calls
• Connectors — most common shadow servers, users running them, top servers to migrate, and which MCP clients are in use
• Skills — shadow skill discoveries over time, most common skills, users with shadow skills, and a per-client breakdown
• Details — the per-device inventory: Client, MCP, Skill, Plugin, Agent, and Custom agent rows with type filters and a managed vs. shadow breakdown
• Devices — AI Watch device fleet mode and health, Sessions health, OS versions, and tool versions across enrolled devices

​

The Devices tab

Open the Shadow AI page and select the Devices tab to answer per-device fleet questions during and after rollout:

• Mode and health — each row shows a Mode badge (Monitor, Protect, or Enforce), a Status badge, and a Sessions badge. Hover an Error or Drifted status to see the error message and when it occurred.
• Versions — the Tool version column shows each device’s installed AI Watch version, alongside OS, OS version, and Last seen. Use this to track upgrade progress.
• Filtering — narrow the table by Detect, Protect, Enforce, or Sessions status, device, user, OS, or OS version; columns are sortable.

---

​

Related Resources