Advanced · Safety

CxBOM (Context-Window Bill of Materials)

Visual diagram · (in preparation) · Math · (in preparation) · Worked example · 3 difficulty levels.

TL;DR. A structured inventory of everything packed into an agent's context window — data sources, tools, memories, fetched documents — used to audit and secure what the model can actually see.

Technical Definition

A structured inventory of everything packed into an agent's context window — data sources, tools, memories, fetched documents — used to audit and secure what the model can actually see.

How it works

CxBOM entered the agentic-security vocabulary at the October 2026 [un]prompted conference. The insight is that an agent's real attack surface is its context window, not just its tools: whatever sits in context can steer behavior through prompt injection, and most teams cannot say what that is at any given moment. A CxBOM answers this the way a software bill of materials answers dependency questions — it enumerates system prompts, retrieved documents, connected memory, tool outputs, and user inputs, each with its origin and trust level. Security teams use it to spot untrusted content flowing into privileged agents, to prove compliance, and to reproduce incidents after the fact. It turns the vague question 'what influenced this agent?' into an auditable list.

Related Concepts

• Agent Memory — Information an agent retains beyond the current context window — episodic history, learned facts, preferences, and task state.
• Context Window — The maximum number of tokens a model can process in a single input, determining information capacity.
• Model Context Protocol (MCP) — An open standard from Anthropic that lets LLM apps connect to external tools, data sources, and prompts through a uniform client–server interface.
• Prompt Injection — An attack where untrusted input (a webpage, email, tool output) contains instructions that hijack an LLM's behavior in an agentic context.