← Field Notes
Shadow AI · Tool

I scanned one Mac and found 30+ AI tools: a Jamf EA for shadow AI

R Rob Flanagan · · 4 min read

You can't govern what you can't see. Before enforcement comes an inventory of which Macs have which AI tools installed. Here is a free Jamf Extension Attribute that builds one and feeds Smart Groups.

I scanned one Mac and found more than 30 AI tools installed. None of them were tracked anywhere. That was the shape of shadow AI on this managed Mac: the tooling was already present, with no inventory of its apps, coding agents, or MCP configurations.

The numbers say the same thing, within the scope of the reports that measured them. Zscaler said its customers blocked 59.9% of measured AI/ML transactions in 2024. Its 2026 report did not publish the 39% comparison previously cited here; it reported 83% year-over-year growth in AI/ML activity across more than 3,400 applications. In IBM and Ponemon's study of 600 breached organizations, one in five reported a breach due to shadow AI. Organizations reporting high shadow-AI use had average breach costs $670,000 higher than those reporting low or no shadow AI, and 63% had no AI governance policy or one still being developed.

Governing is what's left. And governing starts with seeing.

The see step, as a Jamf Extension Attribute

Jamf announced AI Governance as available on June 30. Jamf says it uses Blueprints built on Declarative Device Management and that its OS-level managed-settings file cannot be edited, removed, or replaced by the end user, developer, or local processes. That is the enforce step. But enforcement wants a target, and the target is the list of Macs that actually have a given tool installed.

So I built a free, MIT-licensed Jamf Pro Extension Attribute that answers one question on any Jamf tier: which Macs have AI tooling installed, and of what kind. It reports across four categories that carry real governance risk:

  • Desktop apps like Claude, ChatGPT, Ollama, and LM Studio.
  • CLI coding agents like Claude Code, Codex, Gemini, and aider.
  • Editor and browser extensions such as Copilot, Continue, and Cody.
  • MCP configurations, which can connect an agent to tools and services.

The value drops into Smart Groups, so you can scope a governance profile to exactly the Macs where a given tool is installed before you have hand-audited a single machine. The same inventory pattern is what makes a Rosetta 2 migration view useful before support narrows: measure the installed surface first, then act on the result.

Three things I wanted to get right

The design choices are where this kind of inventory usually goes wrong.

It doesn't scan during recon. A full software scan isn't instant, and an Extension Attribute that scans would slow every inventory run. A background collector runs on its own timer, every four hours by default, and writes a small file. The EA only reads that file, so recon stays fast.

It fails toward "I'm not sure," never toward false trust. The collector runs an offline signature check on anything it trusts by developer ID. If that check fails, the app is flagged for review rather than silently trusted. And if the collector ever stops running, the EA reports the answer as stale instead of handing you an old snapshot as if it were current.

It reads local, installed tooling only. That is the honest limit. AI in a browser tab, tenant and cloud sessions, and personal-account use still need identity, network, or tenant controls on top. Endpoint inventory governs the Mac, not the whole surface.

Where it sits next to Jamf's product

This is not a replacement for Jamf AI Governance, and it isn't trying to be. That product watches live usage and is built to enforce. This EA takes a periodic snapshot and shows you the size of the problem. One measures the fleet; the other acts on it.

If you want the enforce step by hand today, two tools expose managed controls. Claude Code honors an MDM-delivered managed-settings.json; permissions.disableBypassPermissionsMode disables --dangerously-skip-permissions. Codex supports MDM-delivered requirements through com.openai.codex:requirements_toml_base64. I built and tested both profiles before reaching for a product. The hard part they don't cover is discovery across a fleet, which is exactly what the EA is for.

The tool is open source in the macadmin-toolbox repo. It installs from one self-contained script, exposes the collection interval as a Jamf policy parameter, and ships the PPPC profile for the disk access it needs. Point it at one Mac and see what comes back. If it is anything like my test machine, the number will be larger than the count you are tracking today.

Sources

Sources retrieved 2026-07-29. Market figures retain each report's stated measurement scope; product behavior is attributed to the vendor or project that documents it:

← Back to Field Notes