AT&T wants your SBOM to name the AI that wrote the code. I tried to produce one.

AT&T's supplier AI terms (v2.1, October 2025) have a clause that's specific about code. If a supplier's code was produced with an AI tool, the supplier has to submit a software bill of materials "including specification of the AI Solution" with the first delivery and every release after. AI-generated work has to be labelled "AI Generated". Each AI tool needs approval first, and if a supplier uses one that wasn't approved, AT&T has no obligation to pay for that work.

AT&T is the only buyer I've found with wording this exact. A copy of Lockheed Martin's subcontract terms asks for "traceability of AI generated content" on request, which is looser. But I wanted to know how hard it would be to answer the AT&T version for a real repo.

Where the evidence comes from

Most coding agents already stamp their commits. Claude Code adds a Co-Authored-By: Claude line, and recent versions add a Claude-Session link. GitHub's Copilot coding agent adds Agent-Logs-Url. Cursor and Aider have co-author lines of their own. None of this tells you which lines the AI wrote, only that it was involved in the commit.

So I wrote a script that reads those stamps for every commit in a release. It writes the result as a CycloneDX or SPDX file, plus a plain summary. It can also check the result against an allow-list of tools and providers and fail if something else shows up.

A real repo

I ran it on a public repo, pyrail, for one release (v0.4.1 to v0.5.0). 8 of 151 commits carried an AI stamp: 5 from Copilot's coding agent and 5 from Claude Code, with two squash merges carrying both. Those commits touched 20 of the 22 files changed across the release. A "Claude Code only" policy failed and listed the 5 Copilot commits, which is the check a supplier would want before sending the SBOM.

The line count is where it gets shaky. The AI commits added 2,028 of 8,354 lines, but that's an upper bound. A trailer says the agent helped with a commit; it doesn't say which lines it wrote.

What the standards don't have yet

Neither CycloneDX nor SPDX has an agreed field for "this code was written by AI tool X with model Y". I put the tool under CycloneDX formulation, which describes how the release was made. Top-level services would claim the product calls the AI at runtime. In SPDX it's a Tool the package usesTool. Both validate against the official schemas, but it's my mapping, not a standard. There's no field yet for the model, the provider route (Anthropic direct, Bedrock, Vertex), or how the fact was observed.

Limits

It only sees AI use that left a trace. Inline editor suggestions leave none, and stamps can be switched off or lost in a squash. An empty report means no traces, not no AI. I left out detection guesses on purpose, because they can't name the tool or the provider, which is what the clause asks for.

The script is on GitHub: ai-code-sbom. It's one Python file and needs only git.

If a client of yours asks for something like this, I'd like to know what they ask and how you answer it today. There's a one-minute form, or say so in the comments.

Written with AI help.