What is an AIBOM? AI bill of materials explained for security teams | Endor Labs

What it claims

The Endor Labs explainer argues that an AIBOM is an extension of an existing SBOM, not a separate program, and that most of its value is ordinary hygiene rather than malware detection. The page names the non-malicious risks it targets: unpinned models whose weights change silently, deprecated versions still in production, licenses that forbid commercial use, datasets with unclear lineage, and fine-tunes with no recorded base model. Its central rule for authors is that unknowable fields, such as a hosted API's weight hash or partial training-data lineage, should be marked "unknown" and never left blank, because blank fields make an inventory look complete when it is not.

How it works

The page groups AIBOM content into six categories: models and provenance, datasets, software and ML dependencies, AI services and infrastructure, agents with their tools and MCP servers, and security and governance metadata (owner, approval status, risk scores, evaluation results, intended use).

In the CycloneDX example, the fine-tuned model is a machine-learning-model component with a SHA-256 hash of the adapter weights and an Apache-2.0 license. A pedigree.ancestors entry points to the base model by purl, pkg:huggingface/mistralai/Mistral-7B-Instruct-v0.3@<commit-sha>. That link is what answers "are we affected?" when a base model has a problem. The modelCard.modelParameters.datasets field references the fine-tuning dataset. The page says to validate the snippet against the current schema before use.

For a hosted LLM API, the page says to record the exact model identifier, the date it was verified and the contract terms, since the provider can change the model behind the identifier.

How to use it

The page gives a six-step sequence: scan code and configs for model loads, API clients, embedding calls, vector database clients and MCP server configs, including shadow AI prototypes; pin models to a commit or digest and record hashes, registry, license, base model and dataset references; emit CycloneDX or SPDX to match the existing SBOM pipeline and link it to the application SBOM; feed it into SCA, SBOM management and model registry workflows; regenerate in CI/CD and ML pipelines whenever a model is downloaded, fine-tuned, promoted or replaced; and check new entries against a policy on allowed models, licenses and sources before they ship. Training-time and deployment-time AIBOMs can differ.

On formats: CycloneDX added the machine-learning-model type and model card support in version 1.5. SPDX 3.0 added AI and Dataset profiles. The OWASP AIBOM Generator, under the OWASP GenAI Security Project, produces a CycloneDX AIBOM for a Hugging Face model and scores its completeness. The May 2026 CISA/G7 guidance, "Software Bill of Materials for AI: Minimum Elements", groups data into seven clusters: metadata, system-level properties, models, dataset properties, infrastructure, security properties and key performance indicators. It is voluntary and layers on CISA's general SBOM minimum elements.

Limits

No single AIBOM schema is universally adopted, and the page advises choosing the format customers ask for. The EU AI Act (Annex IV) and ISO/IEC 42001 do not require an AIBOM by name. The page cites no aggregate data on how many AI supply chain incidents are malicious. An AIBOM cannot record which shell commands, files, MCP tool calls or package installs a coding agent performed. Endor Labs says that requires audit logs plus deterministic policy blocking destructive commands and unapproved MCP servers. The page is a vendor explainer that promotes Endor Labs' own approach to governing models as dependencies.