AI agent security needs a composition graph, not just an SBOM | Dark Hacker News