Execution-bound advisory automation for agentic AI: a reproducible AIBOM-driven CSAF-VEX framework
Petar Radanliev, Omar Santos, Carsten Maple, Kay Atefi
cs.SE cs.AI
Abstract
A protocol driven framework is presented that binds SBOM and AIBOM artefacts to deterministic environment capture and structured runtime telemetry. Exploitability is computed from declared artefacts, observed activation conditions, and enforced execution policies. CSAF VEX advisories are generated from combined static and runtime evidence, cryptographically signed, and validated through deterministic replay. Evaluation uses approximately 10000 component entries across synthetic Agentic AI workloads 50 to 5000 components, incorporating OSV, GitHub Advisory, KEV, and EPSS datasets.
Topics
Classified with taxonomy v2 on Sat, 5 Sept 2026.