Why does shipping AI-written code leave no record of which model wrote it?

AI assistants now author a significant and growing fraction of production code, but no artifact format records which model, version, or prompt produced a given function. When a vulnerability is traced to a pattern that a specific model generation reliably introduces, there is no way to query a codebase or package registry to find every function that shares the same origin. Software Bills of Materials standardized by SPDX and CycloneDX capture library dependencies, not authorship provenance of source code. The 2026 Cloudsmith supply-chain survey found 29 percent of respondents identify AI-generated package risk as their top open-source security concern, and three quarters of organizations treat SBOMs as static compliance artifacts rather than active governance instruments. The EU AI Act and the US Executive Order on AI both reference software supply-chain integrity but neither specifies w