Shadow AI Detector

Monitors AI usage and enforces your organization's AI policy. Requires the licensed management agent — passive without it.

Shadow AI Detector is the browser component of PingOne Privilege. It monitors how web-based AI services are used in your organization's browsers and enforces your organization's AI usage policy in the request path. Important - works only with PingOne Privilege. This extension is not a standalone tool. It does nothing on its own: every feature requires the PingOne Privilege agent, installed on the same machine by your organization, running under a valid PingOne Privilege license. The agent is the product's brain — it holds the license entitlement, resolves your organization's AI policy, and receives the extension's reports. Without that licensed agent running locally, the extension stays completely passive: it detects nothing, blocks nothing, and reports nothing. There is no setup you can perform inside the extension itself; deployment and licensing are handled by your organization's IT/security team through PingOne Privilege. What it does when connected to the licensed agent - Detects visits to AI services with per-tab session duration and activity counts - Detects AI inference API calls from tabs, workspace apps, browser sidebars and extension backgrounds - Detects AI embedded inside workspace suites: attributed to the specific app, not just the domain - Detects OAuth consent flows toward AI agents, with permission-scope and redirect-URL risk analysis - Detects AI assistant browser extensions installed in the browser - Records large pastes and copies on AI sites as length plus a local classification (email / phone / code) — the text itself is never read or reported - Records file uploads and downloads between the user and AI services — file name, size and type only, never the contents - Detects API keys or bearer tokens sent to AI services — only the first 12 characters are recorded, never the full token - Notes voice-prompt, camera/microphone/screen-capture signals on AI sites, and use of built-in browser AI APIs (window.ai, Summarizer, and related) - Enforces your organization's tiered AI policy — organization-wide, per group, per user: a denied AI service is redirected to a blocked page and its AI API calls are cancelled. Denies on embedded workspace AI are surgical. All detected events go only to the locally installed, licensed PingOne Privilege agent, which forwards them to your security console. Permissions This is an organization-deployed monitoring tool: it must observe AI activity wherever it happens in the browser and block it wherever it comes from, and AI services appear on new domains continuously, so it requests access to all sites by design. Activity is recorded only for AI-related sites and flows; other sites produce no events. The extension does not read the content you type, paste, copy or upload, does not capture your screen, camera or microphone, does not collect full tokens, and does not sell data or use it for advertising. Requirements - The PingOne Privilege agent installed on the same machine by your organization - A valid PingOne Privilege license - Administration by your organization's IT/security team Without the licensed agent the extension remains passive - it collects nothing and blocks nothing until it first syncs a policy from your organization's agent.