What happened
Google Cloud open-sourced (July 13, 2026) k8s-aibom, an unprivileged Kubernetes controller that continuously discovers running AI runtimes (vLLM, Triton, TGI, Ollama), agent frameworks (LangChain, AutoGen, CrewAI), and vector stores from live cluster state and auto-generates standards-conformant CycloneDX 1.6 ML-BOM documents with no sidecars, eBPF, or privileged DaemonSets required.
Why it matters
Addresses shadow-AI/AI-SPM visibility gap by producing audit-grade, runtime-derived AI bills-of-materials without developer friction or privileged access, complementing build-time BOM scanners and posture-management tools with a standards-based (OWASP CycloneDX) open-source alternative.
Applicability
Platform security and compliance teams running GKE (or other Kubernetes) clusters with AI workloads should evaluate k8s-aibom now for shadow-AI discovery and AI supply-chain audit trails.