{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,26]],"date-time":"2026-10-26T04:03:54Z","timestamp":1792987434359,"version":"4.5.0"},"reference-count":62,"publisher":"Frontiers Media SA","license":[{"start":{"date-parts":[[2026,5,14]],"date-time":"2026-05-14T00:00:00Z","timestamp":1778716800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["frontiersin.org"],"crossmark-restriction":true},"short-container-title":["Front. Artif. Intell."],"abstract":"<jats:sec>\n                    <jats:title>Introduction<\/jats:title>\n                    <jats:p>Agentic AI systems integrate foundation models, prompt templates, tool connectors, orchestration logic, and containerised dependencies, creating exploitability conditions that cannot be inferred from static Software Bills of Materials (SBOMs). Artificial Intelligence Bills of Materials (AIBOM) extend transparency to AI-specific artefacts, yet current CSAF\/VEX workflows remain based on static component\u2013CVE correlation without runtime validation.<\/jats:p>\n                  <\/jats:sec>\n                  <jats:sec>\n                    <jats:title>Materials and methods<\/jats:title>\n                    <jats:p>A protocol-driven framework is presented that binds SBOM and AIBOM artefacts to deterministic environment capture and structured runtime telemetry. Exploitability is computed from declared artefacts, observed activation conditions, and enforced execution policies. CSAF-VEX advisories are generated from combined static and runtime evidence, cryptographically signed, and validated through deterministic replay. Evaluation uses approximately 10,000 component entries across synthetic Agentic AI workloads (50\u20135,000 components), incorporating OSV, GitHub Advisory, KEV, and EPSS datasets.<\/jats:p>\n                  <\/jats:sec>\n                  <jats:sec>\n                    <jats:title>Results<\/jats:title>\n                    <jats:p>Under controlled experimental conditions, the framework achieves an F1-score of 0.93 (precision 0.96, recall 0.92), reduces false positives by up to 42% relative to static SBOM\u2013CVE matching without runtime validation, and alters exploitability outcomes in 31% of AI-specific artefact cases through AIBOM extension. Advisory artefacts remain reproducible under deterministic replay.<\/jats:p>\n                  <\/jats:sec>\n                  <jats:sec>\n                    <jats:title>Discussion<\/jats:title>\n                    <jats:p>Binding AIBOM artefacts to runtime telemetry transforms CSAF-VEX generation from static disclosure into execution-grounded exploitability assessment for Agentic AI supply chains.<\/jats:p>\n                  <\/jats:sec>","DOI":"10.3389\/frai.2026.1826384","type":"journal-article","created":{"date-parts":[[2026,5,14]],"date-time":"2026-05-14T05:44:58Z","timestamp":1778737498000},"update-policy":"https:\/\/doi.org\/10.3389\/crossmark-policy","source":"Crossref","is-referenced-by-count":3,"title":["Execution-bound advisory automation for agentic AI: a reproducible AIBOM-driven CSAF-VEX framework"],"prefix":"10.3389","volume":"9","author":[{"given":"Petar","family":"Radanliev","sequence":"first","affiliation":[{"name":"Department of Computer Sciences, University of Oxford","place":["Oxford, United Kingdom"]},{"name":"The Alan Turing Institute","place":["London, United Kingdom"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Omar","family":"Santos","sequence":"additional","affiliation":[{"name":"Cisco Systems","place":["Durham, NC, United States"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Carsten","family":"Maple","sequence":"additional","affiliation":[{"name":"The Alan Turing Institute","place":["London, United Kingdom"]},{"name":"University of Warwick \u2013 WMG","place":["Coventry, United Kingdom"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Kayvan","family":"Atefi","sequence":"additional","affiliation":[{"name":"Department of Computer Science, School of Digital and Physical Sciences, Faculty of Science and Engineering, University of Hull","place":["Hull, United Kingdom"]}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1965","published-online":{"date-parts":[[2026,5,14]]},"reference":[{"key":"ref1","year":""},{"key":"ref2","volume-title":"\u2018Rethinking VEX\u2019, Blogger, Dec-2022. [Online]","author":"Alrich","year":""},{"key":"ref3","author":"Alrich","year":""},{"key":"ref4","author":"Alrich","year":""},{"key":"ref5","author":"Alrich","year":""},{"key":"ref6","doi-asserted-by":"publisher","first-page":"535","DOI":"10.1080\/19393555.2025.2498466","article-title":"Vulnerability scoring metric of CVSS needs to be adjusted per each product: our analysis on Linux and apache","volume":"34","author":"Azizi","year":"2025","journal-title":"Inf. Secur. J. Glob. Perspect."},{"key":"ref7","first-page":"141","author":"Beninger","year":"2024"},{"key":"ref8","author":"Biden","year":""},{"key":"ref9","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1038\/s41746-021-00403-w","article-title":"Building resilient medical technology supply chains with a software bill of materials","volume":"4","author":"Carmody","year":"2021","journal-title":"NPJ Digit. Med."},{"key":"ref10","first-page":"2085","author":"Chirigati","year":"2016"},{"key":"ref11","year":"2023"},{"key":"ref12","year":""},{"key":"ref13","year":""},{"key":"ref14","year":""},{"key":"ref16","year":""},{"key":"ref17","doi-asserted-by":"crossref","DOI":"10.2172\/1901825","article-title":"Towards software bill of materials in the nuclear industry","author":"Eggers","year":"2022"},{"key":"ref18","author":"Elias","year":""},{"key":"ref19","first-page":"37","author":"Garcia","year":"2025"},{"key":"ref20","year":"2025"},{"key":"ref21","article-title":"Concise Software Identification Tags - RFC 9393","volume-title":"NIST, The MITRE Corporation, Internet Engineering Task Force (IETF)","author":"Henk","year":"2023"},{"key":"ref22","author":"Howard","year":""},{"key":"ref23","first-page":"275","volume-title":"Provenance and Annotation of Data and Processes. IPAW 2014. Lecture Notes in Computer Science - Springer","author":"Huynh","year":"2015"},{"key":"ref24","year":"2025"},{"key":"ref25","author":"Jackson","year":""},{"key":"ref26","first-page":"13","author":"Jia","year":"2025"},{"key":"ref27","doi-asserted-by":"crossref","first-page":"576","DOI":"10.1109\/MSR66628.2025.00090","article-title":"A dataset of software bill of materials for evaluating SBOM consumption tools","volume-title":"2025 IEEE\/ACM 22nd International Conference on Mining Software Repositories (MSR)","author":"Kishimoto","year":"2025"},{"key":"ref15","article-title":"Managing the Risks and Realising the Opportunities of using Third Party Software Asset Management (SAM) Providers","volume-title":"Deloitte","author":"Kunorubwe","year":"2018"},{"key":"ref28","author":"Lemay","year":"2025"},{"key":"ref29","author":"Li","year":"2025"},{"key":"ref30","author":"Lim","year":"2025"},{"key":"ref31","author":"Manion","year":""},{"key":"ref32","author":"Meyers","year":""},{"key":"ref33","volume-title":"Scudo: A Proposal for Resolving Software Supply Chain Insecurities in Vehicles the Second in a Series of Whitepapers on Emerging and Critical Issues in Automotive Cybersecurity","author":"Moore","year":""},{"key":"ref34","year":""},{"key":"ref35","year":""},{"key":"ref36","volume-title":"Software Bill of Materials (SBOM) | National Telecommunications and Information Administration","year":"2021"},{"key":"ref37","year":""},{"key":"ref38","year":"2021"},{"key":"ref39","author":"O\u2019Driscoll","year":""},{"key":"ref40","year":""},{"key":"ref41","year":""},{"key":"ref42","doi-asserted-by":"publisher","first-page":"101","DOI":"10.1109\/MSEC.2025.3528535","article-title":"Software bill of materials as a proactive defense","volume":"23","author":"Okhravi","year":"2025","journal-title":"IEEE Secur. Priv."},{"key":"ref43","year":""},{"key":"ref44","year":""},{"key":"ref45","first-page":"56","article-title":"LiPSBOMaker: a prototype of multi-stage Linux distribution package SBOM generator","author":"Qiu","year":"2025"},{"key":"ref46","first-page":"1712","author":"Rabbi","year":"2025"},{"key":"ref47","author":"Royce","year":""},{"key":"ref48","volume-title":"Vulnerability management with CSAF \u2013 why SBOM is not enough","author":"Schmidt","year":"2022"},{"key":"ref49","volume-title":"Media Faculty in Cooperation with the Development of an API to Request Security Advisories for CSAF 2.0 by Enterprise and IT Security Supervision","author":"Schmidt","year":""},{"key":"ref50","year":""},{"key":"ref51","author":"Springett","year":""},{"key":"ref52","author":"Surapaneni","year":""},{"key":"ref53","year":""},{"key":"ref54","year":"2024"},{"key":"ref55","doi-asserted-by":"publisher","first-page":"2297","DOI":"10.1093\/COMJNL\/BXU101","article-title":"Reference ontology for cybersecurity operational information","volume":"58","author":"Takahashi","year":"2015","journal-title":"Comput. J."},{"key":"ref56","year":"2021"},{"key":"ref57","year":"2025"},{"key":"ref58","year":""},{"key":"ref59","author":"Wiesner","year":""},{"key":"ref60","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1038\/sdata.2016.18","article-title":"The FAIR guiding principles for scientific data management and stewardship","volume":"3","author":"Wilkinson","year":"2016","journal-title":"Sci. Data"},{"key":"ref61","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1038\/s41597-019-0184-5","article-title":"Evaluating FAIR maturity through a scalable, automated, community-governed framework","volume":"6","author":"Wilkinson","year":"2019","journal-title":"Sci. Data"},{"key":"ref62","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3714464","article-title":"Research directions in software supply chain security","volume":"34","author":"Williams","year":"2025","journal-title":"ACM Trans. Softw. Eng. Methodol."}],"container-title":["Frontiers in Artificial Intelligence"],"original-title":[],"link":[{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/frai.2026.1826384\/full","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,5,14]],"date-time":"2026-05-14T05:45:03Z","timestamp":1778737503000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/frai.2026.1826384\/full"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,14]]},"references-count":62,"alternative-id":["10.3389\/frai.2026.1826384"],"URL":"https:\/\/doi.org\/10.3389\/frai.2026.1826384","relation":{},"ISSN":["2624-8212"],"issn-type":[{"value":"2624-8212","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,5,14]]},"article-number":"1826384"}}