← Field Notes
Shadow AI · Tool

I scanned one Mac and found 30+ AI tools: a Jamf EA for shadow AI

R Rob Flanagan · · 4 min read

You can't govern what you can't see. Before enforcement comes an inventory of which Macs have which AI tools installed. Here is a free Jamf Extension Attribute that builds one and feeds Smart Groups.

I scanned one Mac and found more than 30 AI tools installed. None of them were tracked anywhere. That is the shape of shadow AI on a managed fleet right now: the tooling is already on the machines, and most IT teams have no inventory of which Macs have which apps, coding agents, or MCP servers installed.

The numbers say the same thing. A year ago enterprises blocked close to 60% of AI traffic; Zscaler's 2026 report puts that at 39%, while AI/ML transaction volume rose 83% year over year. Blocking is losing to usage. IBM's 2025 breach report tied shadow AI to breaches at one in five organizations, added roughly $670K to the average breach where it ran heavy, and found 63% of breached orgs with no AI governance policy or one still being written.

Governing is what's left. And governing starts with seeing.

The see step, as a Jamf Extension Attribute

Jamf's own AI Governance product went GA on June 30, and it enforces policy through Declarative Device Management: a managed-settings file at the OS level that the user, the app developer, and local processes can't edit or remove. That is the enforce step, and it is the right tool for it. But enforcement wants a target, and the target is the list of Macs that actually have a given tool installed.

So I built a free, MIT-licensed Jamf Pro Extension Attribute that answers one question on any Jamf tier: which Macs have AI tooling installed, and of what kind. It reports across four categories that carry real governance risk:

  • Desktop apps like Claude, ChatGPT, Ollama, and LM Studio.
  • CLI coding agents like Claude Code, Codex, Gemini, and aider.
  • Editor and browser extensions such as Copilot, Continue, and Cody.
  • MCP servers, the wiring that lets an agent act on local files and services.

The value drops into Smart Groups, so you can scope a governance profile to exactly the Macs where a given tool is installed before you have hand-audited a single machine.

Three things I wanted to get right

The design choices are where this kind of inventory usually goes wrong.

It doesn't scan during recon. A full software scan isn't instant, and an Extension Attribute that scans would slow every inventory run. A background collector runs on its own timer, every four hours by default, and writes a small file. The EA only reads that file, so recon stays fast.

It fails toward "I'm not sure," never toward false trust. The collector runs an offline signature check on anything it trusts by developer ID. If that check fails, the app is flagged for review rather than silently trusted. And if the collector ever stops running, the EA reports the answer as stale instead of handing you an old snapshot as if it were current.

It reads local, installed tooling only. That is the honest limit. AI in a browser tab, tenant and cloud sessions, and personal-account use still need identity, network, or tenant controls on top. Endpoint inventory governs the Mac, not the whole surface.

Where it sits next to Jamf's product

This is not a replacement for Jamf AI Governance, and it isn't trying to be. That product watches live usage and is built to enforce. This EA takes a periodic snapshot and shows you the size of the problem. One measures the fleet; the other acts on it.

If you want the enforce step by hand today, two tools make it clean. Claude Code honors an MDM-delivered managed-settings.json, including shutting off --dangerously-skip-permissions. Codex accepts managed preferences under com.openai.codex. I built and tested both profiles before reaching for a product. The hard part they don't cover is discovery across a fleet, which is exactly what the EA is for.

The tool is open source in the macadmin-toolbox repo. It installs from one self-contained script, exposes the collection interval as a Jamf policy parameter, and ships the PPPC profile for the disk access it needs. Point it at one Mac and see what comes back. If it is anything like my test machine, the number will be larger than the count you are tracking today.

Sources

The market figures are from named vendor and analyst reports; the manual-governance claims trace to each tool's own admin docs. Links below:

← Back to Field Notes