Execution-bound advisory automation for agentic AI: a reproducible AIBOM-driven CSAF-VEX framework

Petar Radanliev; Omar Santos; Carsten Maple; Kay Atefi

cs.SEJun 16, 2026

Execution-bound advisory automation for agentic AI: a reproducible AIBOM-driven CSAF-VEX framework

Authors: Petar Radanliev, Omar Santos, Carsten Maple, Kay Atefi

Organizations: Department of Computer Sciences, University of Oxford, Wolfson Building, Parks Rd, Oxford OX1 3QG · The Alan Turing Institute, British Library, 96 Euston Rd., London NW1 2DB · Cisco Systems, RTP, North Carolina, United States · University of Warwick – WMG, 6 Lord Bhattacharyya Way, Coventry CV4 7AL · Department of Computer Science, School of Digital & Physical Sciences, Faculty of science and Engineering, University of Hull

Abstract

A protocol driven framework is presented that binds SBOM and AIBOM artefacts to deterministic environment capture and structured runtime telemetry. Exploitability is computed from declared artefacts, observed activation conditions, and enforced execution policies. CSAF VEX advisories are generated from combined static and runtime evidence, cryptographically signed, and validated through deterministic replay. Evaluation uses approximately 10000 component entries across synthetic Agentic AI workloads 50 to 5000 components, incorporating OSV, GitHub Advisory, KEV, and EPSS datasets.

Explore similar work

AgentRiskBOM: A Risk-Scoping Security Bill of Materials for Agentic AI Systems
Jun 20, 2026Srimonti Dutta, Akshata Kishore MoharirArtificial Intelligence Safety Agentic Systems
AgentTrust: Runtime Safety Evaluation and Interception for AI Agent Tool Use
May 6, 2026Chenglin YangRuntime Enforcement Artificial Intelligence Safety
Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Sep 10, 2026Divyanshu Kumar, Nitin Aravind Birur, Tanay Baswa +2Red-Teaming Agentic Evaluations

Jun 20, 2026 · cs.AIJ/K move · Enter open · S save

AgentRiskBOM: A Risk-Scoping Security Bill of Materials for Agentic AI Systems

Srimonti Dutta, Akshata Kishore Moharir

WAI USA Research Labs · WAI USA · Austin, USA · Seattle, USA

Agentic AI systems retrieve private context, invoke tools, write files, call external services, coordinate with other agents, and may act without human approval. Existing bill of materials artifacts improve transparency for dependencies, model metadata, and training provenance, but leave an agentic transparency gap: capability opacity, the absence of a structured account of what a deployed agent can access, remember, change, delegate, and prove afterward. This paper introduces AgentRiskBOM, a security BOM for risk-scoping tool-using AI agents. It is an additive layer over SBOM, AIBOM, and MLBOM artifacts, referencing them where authoritative while adding fields for runtime authority: autonomy, tool permissions, memory, credential scope, approval gates, audit signals, inter-agent communication, and external action capability. We implement AgentRiskBOM as a JSON-schema artifact with a reproducible corpus, risk scenarios, scorer, diff detector, control mapper, and reports. We evaluate AgentRiskBOM on 13 open-source agents spanning coding, RAG, and multi-agent archetypes, plus 52 risk scenarios across 14 categories. The schema validates all 13 corpus artifacts. Coverage analysis gives AgentRiskBOM a native-equivalent score of 14 across 16 capability dimensions, vs. 1 for SBOM, 1.5 for AIBOM and 2 for MLBOM. Across modeled risk categories, AgentRiskBOM exposes 100% risk-category visibility vs. 10.5% for SBOM-like and 20.9% for AIBOM-like views. To test agentic authority drift, we inject 33 structured deployment mutations; the diff detector identifies the correct change type for all mutations. A secondary penalty-based scorer yields a Spearman correlation of 0.73 with the primary scorer, supporting rank-level consistency while showing that thresholds require human calibration. The results show that agentic AI security needs a machine-readable authority-and-risk artifact before incidents occur.

Artificial Intelligence Safety Agentic Systems Artificial Intelligence Agents

Open paper Ask about it PDF

Abstract

Explore similar work

AgentRiskBOM: A Risk-Scoping Security Bill of Materials for Agentic AI Systems

AgentTrust: Runtime Safety Evaluation and Interception for AI Agent Tool Use

Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery