From SBOM to Agentic AIBOM: Schema Extensions, Agent Orchestration, and Reproducibility Evaluation

The research proposes the Agentic AIBOM framework, which extends static SBOMs into policy-constrained multi-agent provenance artifacts. Three types of agents respectively handle environment reconstruction, dependency drift monitoring, and vulnerability and VEX reasoning, and standard-aligned schema extensions are made for CycloneDX and SPDX, expressing exploitability with CSAF v2.0 semantics. Evaluation shows that it outperforms existing provenance systems in runtime dependency capture, reproducibility, and vulnerability explanation stability, with low overhead.