Google has open-sourced a Kubernetes controller that automatically detects unauthorized AI models and agent frameworks running in production environments, creating tamper-proof audit records for regulatory compliance. Released on July 13, 2026, k8s-aibom addresses what Google's security engineers describe as a critical vulnerability: most enterprises have no visibility into the AI workloads actually running on their infrastructure.

Why Are Hidden AI Workloads Such a Big Problem?

The core issue is straightforward but alarming. Developers deploy machine learning models, inference servers, and agent frameworks without enterprise oversight, creating what the tool calls "shadow AI." These unregistered workloads operate in production without documentation, version tracking, or security review. Google's security engineers framed this as a "P0 (highest priority) challenge for the entire planet," noting that 99% of enterprise vulnerabilities aren't in the code written in core applications, but in the deep tree of underlying dependencies.

The problem extends beyond simple visibility. When an AI model or agent framework runs undocumented in production, organizations cannot assess security risks, verify licensing compliance, track model versions, or respond to vulnerabilities. This gap becomes critical under regulatory frameworks like the EU AI Act, NIST AI Risk Management Framework, and ISO/IEC 42001, which increasingly require documented inventories of AI systems in use.

How Does k8s-aibom Actually Work?

The tool operates as an unprivileged Kubernetes controller running in its own namespace, meaning it requires no special system permissions, sidecars, or kernel-level modifications. It continuously scans container images, environment variables, and command-line arguments to identify active AI infrastructure in real time, rather than relying on static code analysis before deployment.

When k8s-aibom detects AI workloads, it automatically generates standard CycloneDX 1.6 Machine Learning Bill of Materials (ML-BOM) documents. These documents create an inventory that integrates into Kubernetes clusters or exports to external storage like Google Cloud Storage. Critically, the controller writes these records using a dedicated service account with a "DoesNotExist" precondition, making the audit trail impossible to overwrite once created.

What Types of AI Infrastructure Can It Detect?

The tool identifies a broad range of AI components commonly deployed in production environments:

• Model Runtimes: vLLM, Triton, and Ollama, which serve language models and other AI systems to applications
• Agent Frameworks: LangChain, AutoGen, and CrewAI, which orchestrate multi-step AI workflows and tool use
• Vector Databases: Milvus, Qdrant, and pgvector, which store embeddings for retrieval-augmented generation (RAG) and semantic search

The tool categorizes discovered assets into three tiers. Declared assets are explicitly configured in workload parameters by engineers. Inferred assets represent frameworks caught dynamically via runtime signature matching. Unresolved assets denote detected AI activity where specific versions or weights cannot be verified.

Why Does This Matter for AI Agent Frameworks Specifically?

The emergence of agentic AI, where systems autonomously call tools and make decisions, has accelerated the deployment of agent orchestration frameworks like LangChain, CrewAI, and others. These frameworks enable powerful automation but also introduce complexity. A single agent framework might integrate with multiple external APIs, databases, and models, creating a sprawling dependency tree that's difficult to track manually.

When these frameworks run undocumented, the risk multiplies. An agent framework might be calling external APIs without rate limiting, accessing sensitive data through unvetted integrations, or using outdated models with known vulnerabilities. k8s-aibom's ability to detect these frameworks at runtime gives security teams the visibility they need to govern agentic AI deployments before they become compliance liabilities.

How Are Teams Actually Building Local AI Agents in 2026?

Interestingly, many organizations are moving toward local AI agent deployment to reduce costs and improve privacy. Seven Python frameworks have emerged as the standard tools for orchestrating agents on local infrastructure: Ollama (a lightweight runtime for open-source models), smolagents from Hugging Face (which emphasizes code-based agent actions), PydanticAI (which ensures type-safe tool calls), CrewAI (which simplifies multi-agent collaboration), AgentScope (built for production from the start), LangGraph (which handles stateful, branching workflows), and Microsoft Agent Framework (the unified successor to AutoGen).

The appeal of local deployment is clear: no API keys required, no per-token costs once a model is downloaded, and no data leaving the network. However, this shift creates a new operational challenge. Teams running agents locally still need orchestration layers that understand how to coordinate with models on their own hardware, and they still need visibility into what those agents are actually doing in production.

Steps to Implement AI Workload Visibility in Your Infrastructure

• Deploy k8s-aibom as a Controller: Install the tool as an unprivileged Kubernetes controller in its own namespace to begin continuous scanning of active AI workloads without requiring elevated permissions or kernel modifications
• Configure ML-BOM Export: Set up automated export of Machine Learning Bill of Materials documents to a secure, immutable storage location like Google Cloud Storage to create an audit trail that cannot be tampered with after creation
• Map Your Agent Framework Dependencies: Document which agent frameworks, model runtimes, and vector databases your teams are using, then cross-reference detected workloads against this inventory to identify undocumented deployments
• Establish Governance Policies: Define which AI components are approved for production use, then use k8s-aibom's detection capabilities to enforce compliance and flag unauthorized deployments for review

The broader implication is clear: as AI agents become more autonomous and more deeply integrated into production systems, the ability to see what's actually running becomes non-negotiable. k8s-aibom addresses a real gap in enterprise AI governance, one that regulators are increasingly demanding organizations fill.