October 1, 2026 — Cleveland, OH, AgileBlue is pleased to announce Phase 2 of Shadow AI Monitoring, extending detection beyond AI domain visits to the AI tools actually installed and running inside customer environments:
- AI Coding Assistants
- AI Browser Extensions
- AI Files and Artifacts
- Unauthorized MCP (Model Context Protocol) Connections
Phase 1 answered an essential question: is AI being contacted from your network? Phase 2 answers the harder one: what AI is actually running, what it’s connected to, and who is using it.
Knowing that someone visited ChatGPT or Claude is useful, but it’s only half the picture. Shadow AI has moved out of the browser tab and into IDEs, browser extensions, and the connections between AI tools and internal systems. Developers install coding assistants without approval, extensions show up without review, and AI tools reach internal data through channels traditional security tools don’t watch. Developers install coding assistants without approval, extensions gain permissions to what it’s connected to, and AI tools reach internal data through channels traditional security tools don’t watch. Phase 2 brings that layer into view, running quietly in the background of the platform customers already use, with no new tools and no added complexity.
With this release, customers can:
- Detect AI Coding Assistants: Phase 2 identifies Copilot, Cody, Tabnine, and similar tools, including AI extensions in VS Code, JetBrains, Cursor, and other IDEs, so teams know when proprietary code may be flowing through an unapproved assistant.
- Catch AI Browser Extensions: Coverage spans Chrome, Edge, Firefox, Arc, Brave, and others, with new installs caught in real time between scheduled scans.
- Uncover AI Files and Artifacts: Phase 2 flags model files, AI configuration files such as Cursor rules and Claude Desktop configs, and the plugin and project files AI tools leave behind on disk.
- Spot Unauthorized MCP Connections: For the first time, AgileBlue detects both local and cloud-hosted MCP servers within 15 minutes of activation, including local servers that don’t appear in any config file. MCP is how modern AI tools connect to other systems and data, and it’s a layer most security platforms don’t monitor at all.
- See Who and What Triggered It: Coding tool and MCP detections include user and process attribution, showing exactly which user and which process were involved.
For organizations writing or enforcing an AI acceptable-use policy, this update puts the evidence in their own data. Instead of relying on assumptions or employee surveys, security teams move from wondering whether AI is being used to knowing exactly what’s installed, what it’s connected to, and what it can access, closing the gap between suspicion and evidence before it becomes a breach.
“AI is moving into every business faster than most leadership teams can govern it, and that gap is where real risk lives. Our customers don’t just need to know if AI is being used, they need to know it’s not putting their business, their data, and their reputation on the line without their knowledge. That’s the responsibility we’ve taken on at AgileBlue: giving companies the visibility to lead on AI, not just react to it.”
— Tony Pietrocola, President, AgileBlue
Availability: Phase 1 of Shadow AI Monitoring remains included on all plans at no additional cost for customers who opt in. Phase 2 is available as a paid add-on across all three plans. For customers already using Phase 1, Phase 2 is the natural next step.
The easiest way to see the value is in your own environment. To see what it would surface for your team, or get a personalized demo, visit agileblue.com/get-a-demo.
About AgileBlue
AgileBlue is an AI-native Security Operations (SecOps) platform that autonomously detects, investigates, and responds to cyber threats across cloud, network, and endpoint environments. Built for today’s speed and complexity, AgileBlue combines intelligent automation with 24/7 SOC experts to deliver non-stop protection and trusted partnership.
