Know which AI tools are in use. Not what anyone typed.
GhostAudit measures AI use across your company with a browser extension and a desktop agent. They report the name of the tool and the time spent in it. They can steer people to the tool you approved and warn before sensitive data is pasted. Prompts, responses, page content and full URLs never leave the device.
Example workspace. The AI usage screen, with illustrative names and figures.
| Tool | Status | People | Devices | Active hours | 12 weeks |
|---|---|---|---|---|---|
ChatGPT Enterprise OpenAI | Sanctioned | 1,284 | 1,391 | 2,912 | |
Microsoft 365 Copilot Microsoft | Sanctioned | 1,102 | 1,188 | 1,640 | |
GitHub Copilot GitHub | Sanctioned | 342 | 361 | 1,206 | |
Claude Anthropic · New this month | Under review | 211 | 226 | 388 | |
Cursor Anysphere | Unsanctioned | 64 | 66 | 301 | |
Otter.ai Otter.ai | Unsanctioned | 41 | 44 | 57 | |
DeepSeek DeepSeek · 17 blocked | Prohibited | 9 | 9 | 0.4 |
- Browsers
- Chrome and Edge
- Desktops
- macOS and Windows
- Reporting window
- Five-minute aggregates
- AI tools recognised
- 86 in the catalog
A usage picture built from two small sensors.
Most companies learn which AI tools are in use from a survey, an expense report or an incident. None of those is a measurement. GhostAudit gives you one: for every AI tool it recognises, how many people used it, on how many devices, for how many active hours, and whether that tool is one you have approved.
The browser extension covers AI used on the web, such as ChatGPT, Claude, Gemini or Perplexity. The desktop agent covers native apps such as Cursor or the ChatGPT desktop app, and API traffic from tools that run inside other software, such as GitHub Copilot inside an editor. Both report to the same place, so a person who uses Claude in the browser and Cursor on the desktop appears once.
The first time a sensor sees a tool that is not in your AI inventory, it creates a finding in discovery with the evidence attached: how many people, how many devices, since when.
- People, devices and active hours per tool, by day
- Breakdowns by department and by person, where your identity mode allows it
- Approval status next to every tool: sanctioned, under review, unsanctioned or prohibited
Example workspace. Names and figures are illustrative.
| Device | Sensor | Last seen | |
|---|---|---|---|
NW-MBP-0412 macOS 15.1 | Desktop agent | 9f2c…e41a | 2 min ago |
NW-LT-2207 Windows 11 | Desktop agent | 51ab…07cd | 4 min ago |
Chrome 131 Windows 11 | Browser extension | 51ab…07cd | 4 min ago |
Edge 131 Windows 11 | Browser extension | c80e…2b19 | 11 min ago |
Chrome 131 ChromeOS | Browser extension | 3d6f…a902 | 1 h ago |
The complete list of what is collected, and what never is.
The sensors answer one question, which AI tools are being used, and collection stops there. This is a design constraint in the protocol the sensors speak, and you can verify it: the extension is about 2,300 lines of unminified JavaScript with no third-party code, and the agent can print exactly what it would send with collect --once --dry-run.
Collected: the tool, matched by hostname (such as claude.ai) or process name (such as Cursor.exe). The time, in five-minute windows, and seconds active within each window. Counts of warnings and blocks, and of what people chose next. Device details: operating system, browser and version, and the computer name for the desktop agent. The user, as a name, a hash, or not at all.
Never collected: prompts, responses, keystrokes, form input, clipboard, screenshots, page content, page titles, file names or contents, cookies, full URLs, search queries, or anything about a site or app that is not on your AI tool list. Hostnames that are not on the list are compared in memory and discarded.
Out of the box the extension injects no script into any page: it sees the hostname of the active tab and nothing inside it. Version 1.1 added one optional feature that does run inside AI tool pages, sensitive-data warnings, described below; it is off until an admin turns it on. The extension does not run in incognito or InPrivate windows. The agent does no packet capture and no TLS interception, and asks for none of the macOS privacy permissions (Screen Recording, Accessibility, Full Disk Access). The full account is on privacy by design.
The extension popup, as an employee sees it. Names and figures are illustrative.
Northwind records which AI tools are used on work devices, and for how long. It does not record what you type or see. Questions: [email protected]
- ChatGPTApproved42 min
- ClaudeUnder review18 min
- CursorNot approved6 min
Named, pseudonymous or anonymous. You choose, per organization.
How much the sensors say about who is a setting, and the choice is yours to make with your works council or data protection officer.
- Named. Work email or username. Use this when you need to follow up with individuals, for example to move someone from a personal account to the company workspace.
- Pseudonymous. A salted SHA-256 hash, computed on the device. You can count distinct people and see patterns without the sensors ever sending a name.
- Anonymous. Device-level only. The agent does not even look up who is logged in.
Changing the mode takes effect at each sensor's next check-in. If a sensor receives a mode it does not recognise, it fails closed to anonymous.
Sensor settings in an example workspace.
Point people to the tool you approved, at the moment they open another one.
Every tool in the catalog has a status you control. When you mark a tool unsanctioned and enable warnings, the extension shows a page before the tool opens, the first time each day. When you mark a tool prohibited and enable blocking, the browser refuses to load it and shows the same kind of page without a continue button. Both are off until you turn them on.
A warning works better when it offers somewhere to go. For any tool that is not sanctioned, or for a whole category such as meeting assistants, you can attach a nudge: a short message in your own words and an approved alternative, chosen from your sanctioned tools or your inventory. The page then reads "Your company hasn't approved Gemini for work. Use ChatGPT Enterprise instead", with a button that opens the alternative.
What people do next is counted per tool: switched to the alternative, continued anyway, or closed the tab. That tells you whether the approved tool is a good enough substitute, which is a more useful number than a count of blocks. The address the person was heading to is never stored or sent.
Enforcement happens in the browser extension. The desktop agent observes and reports; it does not block applications.
- A message of up to 280 characters and an approved alternative, per tool or per category
- Outcomes per tool: shown, switched, continued, closed
- A status or nudge change reaches sensors at their next policy check, with no redeployment
Example workspace. Names and figures are illustrative.
Gemini isn’t covered by our data processing agreement. ChatGPT Enterprise is, and your work account already has a seat.
Your choice is counted (switched, continued or closed). The address you were visiting is never stored or sent.
- Gemini → ChatGPT EnterpriseShown 212 times118 switched61 continued33 closed
- Cursor → GitHub CopilotShown 94 times22 switched58 continued14 closed
- Otter.ai → Teams recapShown 37 times19 switched9 continued9 closed
A warning before a card number or an API key is pasted. Checked on the device, reported as a count.
This is an optional feature and it is off by default. When an admin turns it on, the extension checks text at the moment someone pastes it, drops it or picks a text file to upload on an AI tool site from your list. If the text matches a pattern, a banner appears: "This looks like it contains a payment card number. Your company asks you not to paste this into AI tools." In warn mode the paste goes through. In block mode it is stopped, and you decide whether a "Paste anyway" button is offered. File uploads can be warned about but not blocked.
What stays on the device. The check runs inside the browser tab, by pattern matching with validation: checksums for cards and IBANs, valid ranges for Social Security numbers, known formats for keys and tokens. No network request is involved. The pasted text exists only in memory while it is scanned and is never written to storage.
What is sent. One event per tool, category and five-minute window: the tool, the category (for example payment_card), the action (warned, blocked or overridden) and a count of pastes. There is no text, excerpt, length, hash of the content, match position or file name. The count is of pastes, not of matches, so it does not reveal how much was pasted.
What it is not. Detection is pattern based. It misses data it has no pattern for, does not see text that is typed, and cannot read images, PDFs or office documents. It is a prompt to think at the right moment, not a data loss prevention system.
Turning the feature on is what registers the extension's one content script, and only on the AI tool sites in your catalog. With the feature off, the script is not injected anywhere.
- Seven categories: payment card, US Social Security number, IBAN, email and password pair, private key, API key or token, bulk personal data
- Warn or block, per organization, with an optional "Paste anyway"
- One alert per category per day to Slack, Microsoft Teams or a webhook, if you connect one
The banner as an employee sees it, the complete event, and the admin setting. Values are illustrative.
{
"type": "sensitive_data",
"tool_key": "chatgpt",
"category": "payment_card",
"action": "warned",
"count": 2,
"window_start": "2026-11-09T10:00:00Z",
"window_end": "2026-11-09T10:05:00Z",
"user": { "hash": "9f2c…e41a" }
// no text, excerpt, length, hash of the content, position or file name
}- Payment card number
- US Social Security number
- IBAN
- Email and password pair
- Private key
- API key or token
- Bulk personal data
Sensors report the category and a count. The pasted text never leaves the browser tab.
Rolled out with the endpoint tools you already run.
There is nothing for employees to install or sign in to. You create an enrollment token on the Devices page, and the deploy screen generates the policy and script snippets with your server address filled in.
The extension is force-installed by browser policy and configured through managed storage: Google Admin console for Chrome and ChromeOS, Microsoft Intune or Group Policy for Edge and Chrome on Windows, a configuration profile for browsers on macOS. The agent is one command, ghostaudit-agent install, run as root or SYSTEM by Jamf, Kandji, Intune or any tool that can run a script. It is idempotent, so re-running it upgrades in place.
Revoking a device in GhostAudit stops it reporting. Revoking the enrollment token as well stops it for good, and the extension deletes its local data. More for IT teams.
{
"serverUrl": { "Value": "https://ghostaudit.northwind.example" },
"enrollmentToken": { "Value": "vle_REPLACE_ME" },
"disableUserOptions": { "Value": true }
}| You manage endpoints with | Covers | How sensors are rolled out |
|---|---|---|
| Google Admin console | Chrome on any OS, ChromeOS | Force-install by extension ID, then paste the managed policy JSON |
| Microsoft Intune | Edge and Chrome on Windows; agent on Windows and macOS | Settings catalog for the extension; script or package for the agent |
| Jamf Pro | Agent and browsers on macOS | Configuration profile plus a policy that runs the installer |
| Kandji | Agent on macOS | Custom profile plus custom app or script |
| Group Policy | Edge and Chrome on domain-joined Windows | ExtensionInstallForcelist and the extension policy keys |
Sensor details
For the security review. The same facts, with field-level detail, ship as documents alongside each sensor.
- Browser extension
- Chrome and Edge, Manifest V3. Permissions: storage, alarms, tabs, webNavigation, idle, declarativeNetRequest and, since 1.1, scripting with host access to the AI tool sites in the catalog. That host access exists for sensitive-data warnings; the one content script is registered only while that feature is on. No access to other sites, no cookies, history or clipboard permission, not allowed in incognito.
- Desktop agent
- macOS 12 or later and Windows 10 (1809) or later. Samples running processes and established TCP connections every 30 seconds and keeps only catalog matches. Since 1.1 it can also list the AI agent clients and MCP servers configured for the signed-in user; see AI agent discovery. Opens no listening ports and runs no commands from the server.
- Nudges
- Set per tool or per catalog category; the tool-level one wins. Alternative links must be https. Outcomes are counted per tool and five-minute window.
- Sensitive-data warnings
- Off, warn or block. Scans pasted and dropped text up to 200,000 characters and text files up to 5 MB on catalog AI sites, main frame only. Reports category, action and count.
- Time measurement
- Browser: seconds the tool was the visible tab of the focused window while the user was not idle. Windows apps: foreground time. macOS apps: running time (a stated limitation of the current agent).
- Transport
- HTTPS only, TLS 1.2 or later, to your server address. Redirects are not followed. Each device has its own credential; the server stores only a hash of it.
- Offline behaviour
- Events queue on the device (up to 5,000, oldest dropped first) and are sent with backoff when the server is reachable again.
- Catalog
- 86 AI tools: 63 matched by web domain, 16 by desktop process name and 25 by API host.
- Plans
- Included in every plan. See pricing.
Questions
- Can administrators read prompts or see what was pasted into a tool?
No. The sensors do not collect prompts, responses or page content, so there is nothing to read. If you turn on sensitive-data warnings, pasted text is checked inside the browser tab and discarded; administrators see a category such as "payment card" and a count, never the text.
- Does updating the extension to 1.1 need anything from users?
Version 1.1 adds host access to the AI tool sites in the catalog, which the browser requires before a content script can run there. Browsers where the extension is force-installed by policy accept this silently. Where someone installed the extension by hand, Chrome and Edge disable it after the update until that person accepts the new permission.
- Does it track general browsing?
No. Sensors only report activity that matches your AI tool list. Other hostnames are compared in memory and discarded; they are never stored or sent.
- Will employees know it is installed?
Yes, and that is intended. The extension popup and the agent show what is collected alongside a notice you write. We recommend telling people before rollout; privacy by design is written to be shared with them.
- Can the desktop agent block an application?
No. Warnings and blocks are applied by the browser extension to web-based tools. The agent only reports.
- What about personal devices?
Sensors are deployed through device or browser management, so they run where your management reaches. On unmanaged devices, usage is visible only through sources such as Okta or log import in discovery.
- Licence utilisationThe same usage data, set against the AI seats you pay for.
- AI usage reportA shareable summary of what the sensors measured.
- Privacy by designThe employee-facing explanation, for works councils and DPOs.
- Shadow AI discoveryWhat happens when a sensor sees a tool you have not approved.
- AI agent discoveryWhat the desktop agent reports about AI agents and MCP servers.
- Employee AI monitoring noticesWhat New York, Connecticut and Delaware require before rollout.
Measure a pilot group this week.
Start a 14-day trial with every Govern feature, connect one discovery source and enroll a handful of devices. No card is needed to start, and nobody is asked to change how they work.