Detecting Shadow AI: Unsanctioned LLM Agents on Enterprise Endpoints: A Taxonomy, an Open Detector and a Controlled Evaluation

Summary

Agent Detector is an open-source Windows detector for unsanctioned LLM agents on enterprise endpoints. It anchors behaviour to the identity of the remote service and correlates it with configuration, installation and execution history, using a catalog of 39 tools and 184 LLM endpoint entries. On a controlled bench of 12 synthetic agents, 3 AI components and 9 benign workloads, it flagged no behavioural twins, while two behavioural rules flagged all of them.