AT&T is forcing suppliers to name the specific AI tools that write their code, but the current ecosystem of developer tooling and standards can barely keep up. The telecom giant's supplier AI terms, version 2.1 from October 2025, mandate that any code produced with an AI tool must include a Software Bill of Materials (SBOM) specifying the 'AI Solution' used. This isn't just a suggestion; AI-generated work must be labeled 'AI Generated,' and using an unapproved tool voids payment obligations for that work.

The Reality Check on Real Repos

To see if this is actually doable, one developer ran a custom script against a public repository, pyrail, for release v0.5.0. The script scanned 151 commits and found that only 8 carried AI stampsβ€”5 from GitHub Copilot's coding agent and 5 from Claude Code. While these commits touched 20 of the 22 files changed in the release, the attribution remains coarse. A 'Claude Code only' policy failed the check because it couldn't distinguish between the tools in the mixed commits, highlighting the immediate friction for suppliers with strict vendor contracts.

Standards Are Missing the Mark

The bigger issue is that neither CycloneDX nor SPDX has an agreed-upon field for 'this code was written by AI tool X with model Y.' The developer had to hack a solution by placing the tool under CycloneDX formulation, which describes how a release was made, or as a Tool in SPDX. These mappings validate against official schemas but are ad-hoc interpretations, not standards. There is currently no standard field to record the specific model, the provider route (such as Anthropic direct vs. Bedrock), or how the AI usage was observed.

The Evidence Gap in Coding Agents

Current coding agents leave inconsistent trails. Claude Code adds a Co-Authored-By: Claude line, while GitHub's Copilot agent adds Agent-Logs-Url. Cursor and Aider have their own co-author lines. However, none of these tell you exactly which lines the AI wrote, only that it was involved in the commit. The script found that AI commits added 2,028 of 8,354 lines, but that number is an upper bound. A trailer confirms help was given, not that every line was machine-generated. Furthermore, inline editor suggestions often leave no trace at all, meaning an empty report doesn't prove a human wrote the code.

Key Takeaways

  • AT&T's v2.1 supplier terms require specific AI tool attribution in SBOMs, with payment penalties for non-compliance.
  • Neither CycloneDX nor SPDX has native fields for AI model or provider attribution, forcing developers to use ad-hoc mappings.
  • Git trailers from tools like Claude Code and Copilot are the primary evidence source, but they lack line-level precision.
  • A real-world test on the pyrail repo showed that mixed AI usage makes strict vendor allow-lists difficult to enforce automatically.

The Bottom Line

We are building compliance bureaucracy on top of tooling that wasn't designed for it. Until SBOM standards catch up with AI attribution, suppliers are guessing.