Skip to content
Threat Feed
Subscribe

Tag

Shadow-AI

6 briefs RSS
medium advisory

Detection of Local LLM Framework DNS Queries

This brief details the detection of DNS queries originating from local Large Language Model (LLM) frameworks like Ollama, LM Studio, and GPT4All on Windows endpoints, leveraging Sysmon Event ID 22 to identify potential unauthorized AI tool usage or data exfiltration risks associated with model downloads, updates, and telemetry from repositories such as huggingface.co and ollama.ai.

Claude +16 local-llm shadow-ai dns-monitoring data-exfiltration policy-violation windows endpoint-security
1r 3t 18i
medium advisory

Detection of Local LLM Model File Creation on Endpoints

This brief describes how the creation of Large Language Model (LLM) files, including formats like .gguf, .safetensors, .ggml, and Modelfiles, by local AI inference frameworks such as Ollama, llama.cpp, GPT4All, and LM Studio can be detected on Windows endpoints, indicating potential shadow AI deployments, unauthorized model downloads, or rogue LLM infrastructure which poses data exfiltration risks and policy violations.

Ollama +9 shadow-it llm data-exfiltration policy-violation endpoint shadow-ai local-llm intellectual-property-theft +2
2r 5t
high advisory

Securing AI Agents and Governing Shadow AI

CrowdStrike is introducing new capabilities to secure AI agents and govern shadow AI across endpoints, SaaS, and cloud environments by providing detection and response (AIDR) for desktop AI applications, discovery of AI-related components, and runtime security for agents built in Microsoft Copilot Studio to combat attacks like living off the AI land (LOTAIL) by securing the agentic interaction layer.

AI agentic-soc shadow-ai
2r 1t
medium advisory

CrowdStrike Innovations Secure AI Agents and Govern Shadow AI

CrowdStrike is introducing innovations to secure AI agents and govern shadow AI across endpoints, SaaS, and cloud environments by extending AI detection and response (AIDR) capabilities to cover desktop AI applications and provide visibility into AI-related components, helping to prevent prompt attacks, data leaks, and policy violations.

AI AI-Security Shadow-AI Endpoint-Security SaaS Cloud
2r 2t
high advisory

CrowdStrike Falcon Enhancements Secure AI Agents and Govern Shadow AI

CrowdStrike is enhancing its Falcon platform with AI Detection and Response (AIDR) to secure AI agents and govern shadow AI across endpoints, SaaS, and cloud, addressing threats like prompt injection attacks, data leaks, and policy violations.

ai shadow-ai prompt-injection data-leak endpoint-security
2r 3t
medium advisory

CrowdStrike Falcon Enhancements for Securing AI Agents and Governing Shadow AI

CrowdStrike is enhancing its Falcon platform with new AI detection and response capabilities to secure AI agents and govern shadow AI across endpoints, SaaS, and cloud environments, addressing threats like prompt injection and data leaks.

AI-Security Shadow-AI Endpoint-Security
2r