SBOM for Agent-Driven Pipelines: Generation & Compliance

Generate a signed software bill of materials from lock files on every artifact-producing CI/CD build. That approach ties each SBOM to the software the pipeline actually assembled and catches dependency changes introduced by agents.

An agent can merge a dependency between manual inventory exports. Build-time resolution may give the pipeline its first chance to check the package name and version against a registry. An agent dependency study found 45.0% of agent edits introduce entirely new direct dependencies. The USENIX Security 2025 study tested 16 code-generating LLMs across 576,000 code samples and found that LLMs hallucinated 19.7% of generated packages, producing 205,474 unique non-existent names. The CISA 2025 SBOM minimum elements baseline names "Automation Support" as a minimum SBOM element.

Why AI Coding Agents Break Manual SBOM Workflows

Agent-driven development changes both the volume and trustworthiness of dependency decisions. A hallucination re-evaluation across five frontier models measured rates of 4.62% to 6.10%. Across 199,845 prompts, 127 package names were hallucinated identically by all five models, and 53 of those names remained registrable as of April 2026. Agent-specific package risks make AI security benchmarks relevant when evaluating scanner coverage.

The following table compares manual and per-build SBOM workflows.

NIST SP 800-161r1 specifies that enterprises generate an SBOM upon first consumption of each version of every open-source project they use. When an agent adds a dependency in Tuesday's build, Monday's SBOM describes software that no longer exists.

How to Automate SBOM Generation in a CI/CD Pipeline

Automated SBOM generation provides artifact-level coverage when it runs at build time, reads lock files, signs its output, and ships it to a system that re-analyzes components after the pipeline exits.

Step 1: Generate from lock files

A lock-file study of 2,414 open-source repositories found that when Trivy and Syft scan requirements.txt files, both resolve only direct dependencies. Lock files allow accurate output. In practice, enforce npm ci, commit pip-compile output, and generate during compiled-language builds. Rust needs cargo auditable to inject a dependency manifest into the binary.

Step 2: Wire generation into the pipeline

Each shipped artifact receives a machine-readable inventory before deployment. The following table maps scan types to their CI trigger points.

On GitHub, Anchore's SBOM Action can run Syft, upload the SBOM as a workflow artifact, and attach it to release assets. Pin all Actions to commit SHAs rather than mutable tags: on March 19, 2026, attackers compromised the aquasecurity/trivy-action in a supply chain attack. On GitLab, the native path is Dependency Scanning using SBOM, which scans CycloneDX artifacts against the GitLab Advisory Database.

Step 3: Sign and attest

An unsigned SBOM proves nothing about provenance; an attestation binds it cryptographically to a specific image digest. The keyless Sigstore flow in GitHub Actions requires the id-token:write permission, obtains a short-lived certificate from Fulcio, and records the signing event in the Rekor transparency log. GitHub's attest action supports SPDX or CycloneDX predicates, meets SLSA v1.0 Build Level 2, and reaches SLSA Level 3 with reusable workflows.

Step 4: Ingest into a platform that keeps analyzing

Upload every SBOM to Dependency-Track via its REST API. Dependency-Track reanalyzes all components daily against the NVD, GitHub Advisories, and the OSS Index and incorporates EPSS scoring. For a smaller pipeline gate, run:

grype sbom:./sbom.json --fail-on high

to fail the pipeline on high-severity findings. Gate on newly introduced critical vulnerabilities rather than the total backlog.

Step 5: Regenerate every build and diff between releases

Regenerate for every version that reaches an artifact registry or deployed environment. Between releases, the CycloneDX CLI diff subcommand emits structured added/removed/modified output. When an agent adds a package on Tuesday, the Tuesday-to-Monday diff surfaces it as a reviewable event. Tag each SBOM with commit hash, build number, and deployment target.

SBOM Tools: What the Benchmarks Say

SBOM tool selection requires benchmark-based evaluation because mandatory field conformance can reach 100% while semantic completeness remains weak. A large-scale empirical analysis found that all six major tools achieved 100% compliance with mandatory field presence while failing to meet semantic completeness.

The following table compares the major open-source generators. Benchmark figures are from the October 2025 study linked above.

The benchmark data supports a paired approach: use a build-system-native generator plus a container scanner because each reads different evidence. For the same Juice Shop image, Dependency-Track found 35 vulnerabilities in a Trivy SBOM versus 88 in a Syft SBOM, partly because only Syft's output contained the CPEs needed to match against NVD.

For management platforms, OWASP Dependency-Track is the open-source option for teams standardizing on CycloneDX: it consumes CycloneDX SBOMs and VEX documents and monitors continuously. GUAC (OpenSSF) aggregates SBOMs, provenance attestations, and vulnerability reports into a queryable graph.

Regarding AI SBOM standards, CycloneDX 1.6 ships with ratified ML-BOM fields, including model parameters, datasets, and quantitative analysis. SPDX 3.0.1 publishes formal AI and Dataset profiles. CISA and G7 partners released guidance on minimum elements for AI SBOMs. The CycloneDX "Agent BOM" proposal to track MCP servers, tool definitions, and agent credentials remains unratified.

SBOM Compliance Requirements in 2026

SBOM compliance obligations vary sharply by market. The following table reflects enforceability as of mid-2026.

The EU CRA's Article 14 reporting obligations took effect September 11, 2026: manufacturers must report actively exploited vulnerabilities within 24 hours and follow up within 14 days. The SBOM mandate lands December 11, 2027. US medical devices carry a statutory duty independent of executive-branch shifts. The Federal Register notice for CISA's 2025 draft adds four fields to the NTIA baseline: Component Hash, License, Tool Name, and Generation Context. Generation Context matters for agent-driven pipelines because it records how and when the SBOM was produced.

Put SBOM Generation in the Build Before Agents Outrun the Audit

Build-time SBOM generation closes the speed mismatch between agent-created dependencies and quarterly inventories. A one-repository rollout can fit in one sprint: enforce lock files, add a Syft or cdxgen step to every build, attest the output with cosign, and point the results at Dependency-Track. The December 2027 CRA deadline sets the outer bound, but the package hallucination numbers argue for starting sooner.

Augment Cosmos, the unified cloud agents platform, provides dependency reviewers with repository context before agent edits reach CI via Context Engine, which analyzes codebases spanning 400,000+ files using semantic dependency graph techniques. Cosmos Sessions capture auditable, replayable workflows, along with CI edits and release workflows, for reviewing SBOM pipeline changes. Cosmos is generally available and included on all paid plans.

Frequently Asked Questions About SBOMs in Agent-Driven Pipelines

These are the questions platform and security teams ask when implementing build-time SBOM automation for pipelines where AI agents modify dependencies.

Related Guides

• Security Integrations
• Agentic Development Security
• Agent Execution Sandboxes
• AI Vulnerability Audit
• DAST Security Tools