Shadow AI
Shadow AI shows which AI tools your workforce uses, sanctioned or not, across browsers, desktop apps, command-line tools and coding agents. In the product it appears under Discover AI.
What it does
- Discovers usage of the AI tools in the ANTS Tool Registry through a browser extension, desktop agents for macOS and Windows, and coding-agent telemetry.
- Attributes activity to people and devices: who uses which tools, how often, and through which surface (web, desktop app, command line).
- Enriches identities from Okta or Microsoft Entra ID, so usage can be grouped by department, job title and manager.
- Classifies tools as Sanctioned, Tolerated or Unsanctioned, each with a risk level. These classifications drive the reports.
- Steers employees in Warn mode: opening an Unsanctioned tool in the browser shows a banner with your message, the approved alternative and a link to request access.
- Alerts when developers use an Unsanctioned coding assistant or command-line tool, and when a device goes silent, the extension is removed or an agent is unenrolled (tamper and silence alerts).
- Tells employees they are monitored with a notice you write, and records each acknowledgment.
- Handles requests for new AI tools: employees ask through a form, and approval adds them to the Okta group that unlocks the tool. See AI Tool Requests.
Discover AI does not block tools. Observe mode, the default, only detects and reports. Warn mode adds a dismissible banner. Real-time blocking in the browser and on endpoints is on the roadmap.
Metadata by design. The browser extension and desktop agents send usage metadata: tools, sessions, counts, page URLs and titles, models where available, file names and sizes, the command lines of AI command-line tools, and device health. They do not send prompt or response text. Coding-agent telemetry is the exception: prompt and response content is sent only if you turn on content capture for a tool, and it is off by default. See Data & Privacy and Coding-Agent Telemetry.
What it detects
| Surface | How | Examples |
|---|---|---|
| Web AI tools | Browser extension for Chrome, Edge and Firefox | ChatGPT, Claude, Gemini, Microsoft Copilot, Perplexity, plus a broad list of AI domains |
| AI in SaaS apps | Browser extension, at feature level | Microsoft 365 Copilot, Notion AI, Salesforce Einstein, Gemini in Google Workspace, Grammarly |
| Desktop AI apps | Desktop agent (macOS, Windows) | ChatGPT, Claude, Microsoft Copilot, Cursor, Windsurf, Antigravity, Notion AI, Grammarly |
| Command-line and developer tools | Desktop agent (macOS, Windows) | Claude Code, OpenAI Codex CLI, Gemini CLI, GitHub Copilot CLI, Aider, Ollama, llm, goose, Cline |
| MCP servers | macOS desktop agent | Servers configured or called in Claude Code, Claude Desktop, GitHub Copilot CLI and Gemini CLI, shown in the MCP Servers tab |
| AI network traffic | macOS network extension | Connection counts and bytes per device to the AI hosts listed in the registry, and a report of direct calls to AI provider APIs |
| Coding-agent telemetry | OpenTelemetry from the tool | Claude Code, GitHub Copilot CLI, OpenAI Codex CLI |
Only tools in the registry, plus the internal AI tools you add by domain, are detected. Safari is not supported.
How it works
Clients on your fleet send signals to ANTS Platform. Each signal is attributed to a user and device, matched against the Tool Registry, and shown in the Discover AI views.
The product views are:
- AI Usage Intelligence: adoption, active users, trends, top tools, departments, and direct traffic to AI provider APIs.
- AI Tools: inventory tabs for Web AI Tools, Desktop Apps, CLI Tools and MCP Servers, with sanction status and risk.
- Users: each person's tools, activity and devices.
- Devices: each device with its installed clients, version, last check-in and health.
- AI tool requests: employee requests for new AI tools, their decisions and the cycle-time report.
Get started
Deploy clients
Run the enrollment script, then roll out the browser extension and desktop agent. See Quickstart and Deploying Agents & Extensions.
Enrich identities (optional)
Connect Okta or Entra ID so usage can be grouped by department, title and manager. See Directory Integration.
Review and classify
Review the views, then mark tools Sanctioned, Tolerated or Unsanctioned. See Understanding the Dashboard and AI Tools, Registry & Policy.
Steer and alert (optional)
Turn on Warn mode, the monitoring notice, developer tool alerts, tamper and silence alerts, and AI tool requests as your policy requires. Each is off by default.