A new protocol-driven framework aims to automate advisory generation for agentic AI by binding software and AI bill of materials (SBOM and AIBOM) artefacts to deterministic environment capture and structured runtime telemetry, according to a preprint published on arXiv on June 16, 2026. The approach addresses the challenge of continuously assessing exploitability in complex AI systems by computing it from declared artefacts, observed activation conditions, and enforced execution policies.
Framework Components and Workflow
The framework, described by authors Petar Radanliev, Omar Santos, Carsten Maple, and Kay Atefi, ties SBOM and AIBOM artefacts directly to a deterministic snapshot of the execution environment and structured runtime telemetry data. Exploitability is calculated using three inputs: the declared artefacts (component lists), the observed conditions under which components are activated, and the execution policies that are enforced. This combination allows for a precise, repeatable assessment of vulnerabilities.
Advisory Generation and Validation
From the combined static and runtime evidence, the framework generates Common Security Advisory Framework (CSAF) Vulnerability Exploitability eXchange (VEX) advisories. These advisories are cryptographically signed to ensure authenticity and integrity. Validation occurs through deterministic replay, meaning the exact conditions of the environment and runtime can be re-run to confirm the advisory's accuracy. This process ensures that advisories are not only automatically produced but also verifiably correct.
Evaluation Methodology
The researchers evaluated the framework using approximately 10,000 component entries across synthetic Agentic AI workloads ranging from 50 to 5,000 components. The evaluation incorporated data from four public vulnerability datasets:
| Dataset | Description |
|---|---|
| OSV | Open Source Vulnerabilities database |
| GitHub Advisory | Advisories from GitHub Security Lab |
| KEV | Known Exploited Vulnerabilities catalog (CISA) |
| EPSS | Exploit Prediction Scoring System |
These datasets provide a broad coverage of vulnerability information, enabling the framework to test against both known exploited vulnerabilities and predicted exploitability scores.
Implications for Enterprise Security
For technology procurement leaders and supply chain technology managers, the framework offers a reproducible method to generate advisories for AI components in their software supply chain. By binding SBOM and AIBOM artefacts to deterministic environment capture, enterprises can more reliably assess the risk of AI systems before deployment and during operation. The cryptographic signing and deterministic replay add layers of trust and verifiability that are critical for audit-heavy industries such as logistics and trade finance.
The use of open-standard formats (CSAF VEX) and integration with widely adopted vulnerability databases (OSV, GitHub Advisory, KEV, EPSS) suggests that the framework could be adopted into existing security toolchains. While the evaluation uses synthetic workloads, the approach is designed to scale from 50 to 5,000 components, covering a range of agentic AI system sizes.
As agentic AI becomes more prevalent in automating global trade and supply chain decisions, frameworks like this one that enforce structured runtime telemetry and reproducible advisories will become essential for maintaining cybersecurity posture without slowing down digital transformation.
