The Bill of Materials Is a Rumor

The senior developer squints at the Jira ticket. The task is to integrate a new transcription model from a startup that’s barely a year old. He asks the product manager a simple question in the team's Slack channel: "What's in this thing?" The answer comes back as a link to a marketing page promising "state-of-the-art accuracy" and a second link to a five-page whitepaper filled with dense mathematics and no mention of training data. The developer stares at the screen. He has no idea what he’s about to plug into the company’s core product. He’s been asked to install a black box.

This scene is playing out in thousands of engineering teams right now. We spent the last decade painstakingly building a discipline around software supply chain security. We learned the hard way, through catastrophes like Log4Shell and Heartbleed, that you must know your dependencies. The Software Bill of Materials, or SBOM, became a non-negotiable artifact for any serious enterprise. It is a precise, machine-readable manifest of every component, every library, and every transitive dependency that makes up your application. It’s an ingredient list. When a vulnerability is discovered in a common package, you can instantly query your SBOMs to find out where you’re exposed.

That entire discipline is evaporating in the heat of the AI gold rush.

The new critical dependency isn't a versioned library with a clear license and a public source repository. It's a model. And a model does not come with a bill of materials. It comes with an API key and a press release. The "components" of a large language model are not other software packages; they are the petabytes of text and images scraped from the public internet, pirated book repositories, and private corporate datasets. The "manufacturing process" is not a deterministic compiler; it's a stochastic training run on thousands of GPUs, the results of which are not perfectly reproducible.

What is the ingredient list for a model that translates Spanish to English? Is it a few terabytes of Wikipedia? A trove of illegally downloaded novels? The entirety of Reddit from 2008 to 2022? No one will tell you. The provenance of the foundational asset is a closely guarded trade secret, or worse, an unknown even to its creators. We are building on foundations we are not allowed to inspect. The SBOM is now a rumor, a ghost story the old-timers tell about a time when you knew what your software was made of.

The stakes are not academic. A poisoned training set can create subtle, exploitable backdoors in a model's behavior. A model trained on buggy or insecure code will confidently recommend that same insecure code to your developers. When the next supply chain attack happens, the vector won't be a malicious pull request on GitHub. It will be a subtly compromised foundational model served by a trusted provider, an attack that leaves no trace in any log file.

We are trading diligence for velocity. The pressure to ship AI features has led us to treat opaque, billion-parameter artifacts with less scrutiny than we would a five-line JavaScript dependency. We are bolting unauditable, inscrutable systems into the heart of our infrastructure and hoping for the best. The bill of materials is gone, and in its place is an act of faith.