EveMissLab research program · APBSC · Phase I
An agent may see it.That doesn't mean it may publish it.
Coding agents read more of a workstation than any tool before them, and then they commit, push and publish. This program studies the line between what an agent is allowed to observe and what is allowed to leave: how that line fails, why a row of green checks does not prove it held, and how to measure it without becoming one more observer of other people's private context.
- ObservedThe agent reads it while working.
- AuthorizedSomeone allowed its use for the task.
- PersistedIt is written into a file the agent keeps.
- PublishedIt leaves in a commit, package or page.
- ObtainableAnyone can now fetch it.
Run the test suite from /Users/example/work/acme-app using the session token in ~/.config/acme/session.jsonRun the test suite from (removed) using the session token in (removed)Where the evidence stands
Every claim the program makes carries one of three states. Nothing has reached the third yet.
- OObserved
AI collaboration files (
00, 02CLAUDE.md,AGENTS.md,.cursor/rulesand similar) can themselves become publication surfaces. - OObserved
In at least one documented workflow, a checker reported PASS while recoverable excluded information sat inside the checker itself.
00, 03 · case A - OObserved
Public AI collaboration files can contain concrete workstation, runtime, session and internal-network context.
02 · pilot 2026-09-20 - OObserved
In a frozen 60-repository panel, both high-warning results were on agent instruction files; none appeared on README or governance files.
RBPM v0.8.3 - HHypothesis
AI-assisted repositories disclose more than matched non-AI repositories.
00, 07 - HHypothesis
Organizations in the middle of adopting AI agents are the higher-risk band, more than AI-native ones. The 60-repository bridge did not support this direction; it did not reject it either.
company check · RBPM v0.8.1
EEstablished Established: none so far. No prevalence figure, no comparison between groups and no causal claim has been measured well enough to state.
The latest measurement
Sixty public repositories, frozen in advance, measured on three kinds of file without anyone reading them. The only high-warning results sat in agent instruction files.
OObserved RBPM v0.8.3 · N = 60 · Not a prevalence estimate
Ten papers, one argument
Phase I runs from the framework (00) to an algorithm a machine can execute while the researcher stays blind (09). The drafts are internal; each page here gives the argument and its limits.
- 00Agentic publication boundary and security closure: the integrated frameworkFramework
- 01The green-light fallacy: when agent verification succeeds and the real postcondition does notConcept
- 02Agent context as an egress surfaceConcept · taxonomy
- 03From secret scanning to semantic privacyConcept
- 04Organizational agent context propagationHypothesis
- 05AI build–attack asymmetryHypothesis
- 06Researcher-blind privacy measurementMethodology
- 07An empirical study protocol: sampling, matched control and prevalence estimationStudy protocol
- 08Provider and platform responsibility: publication-boundary governance for AI coding toolsGovernance
- 09The researcher-blind publication-boundary measurement algorithmAlgorithm · closes Phase I
Measuring a leak without repeating it
A study that reads leaked paths to prove they leak has just leaked them again, to itself. Here the first observer is a sealed machine process. People and analysis models receive only bounded features: a class, a likelihood, a confidence, an UNKNOWN.
- XPublic current state
- NNormalize
- DDetect
- SSuppress
- FFeature
- AAdjudicate
- OResearch-safe output