SBOM

In the LiteLLM 1.107.0 compromise the bill of materials, the provenance attestation and the image signature were all accurate, and none of them described the files that ran. The payloads in this year's supply chain attacks lived in install hooks, Python startup files and agent instruction files.

NIST asked in February whether agent identities should be tied to specific hardware, software, or organizational boundaries. The summary of the 614 responses it received records commenters proposing an anchor bound to the artifact that produced the agent, with the SBOM carried as metadata for access decisions.

The SBOM was built for software a vendor assembles at build time and ships. An open source agent that writes code and pulls dependencies at runtime breaks that model, and adds a question the format cannot answer: who wrote the code.