.png){kind=icon}
.png){kind=icon}
Return
Execution-bound advisory automation for agentic AI: a reproducible AIBOM-driven CSAF-VEX framework
.png){kind=icon}
OA
AI
DOI：10.3389/frai.2026.1826384.png)
.png){kind=icon}
.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
IntroductionAgentic AI systems integrate foundation models; prompt templates; tool connectors; orchestration logic; and containerised dependencies; creating exploitability conditions that cannot be inferred from static Software Bills of Materials (SBOMs). Artificial Intelligence Bills of Materials (AIBOM) extend transparency to AI-specific artefacts; yet current CSAF/VEX workflows remain based on static component–CVE correlation without runtime validation.Materials and methodsA protocol-driven framework is presented that binds SBOM and AIBOM artefacts to deterministic environment capture and structured runtime telemetry. Exploitability is computed from declared artefacts; observed activation conditions; and enforced execution policies. CSAF-VEX advisories are generated from combined static and runtime evidence; cryptographically signed; and validated through deterministic replay. Evaluation uses approximately 10; 000 component entries across synthetic Agentic AI workloads (50–5; 000 components); incorporating OSV; GitHub Advisory; KEV; and EPSS datasets.ResultsUnder controlled experimental conditions; the framework achieves an F1-score of 0.93 (precision 0.96; recall 0.92); reduces false positives by up to 42% relative to static SBOM–CVE matching without runtime validation; and alters exploitability outcomes in 31% of AI-specific artefact cases through AIBOM extension. Advisory artefacts remain reproducible under deterministic replay.DiscussionBinding AIBOM artefacts to runtime telemetry transforms CSAF-VEX generation from static disclosure into execution-grounded exploitability assessment for Agentic AI supply chains.
Keywords:
agentic AI
AI supply chain security
artificial intelligence bill of materials
CSAF-VEX automation
execution-bound exploitability
runtime telemetry
AI Summary
Key information extracted from the uploaded paper, including a brief overview, abstract, background, key highlights, visual analysis, and future outlook.
Journal
F
IF:
4.7
Papers:
2.3K
Citations:
4.4K
View more organizations