Shadow IT has given way to shadow AI. Enter AI-BOMs

The article explains the concept of AI Bills of Materials (AI-BOMs) and model provenance tooling to give organizations visibility into AI assets (models, datasets, agents, prompts, SDKs, identities) and track state changes. It highlights risks from shadow AI, model/skill poisoning, poisoned open-source packages, and attackers using AI to perform automated reconnaissance and modify system prompts to exfiltrate data. Vendors (Cisco, Wiz, Google) and security practitioners argue that AI-BOMs and provenance tracking help detect supply-chain tampering, unauthorized model changes, and compromised dependencies to speed detection and response.