Agent context as an egress surface

The argument

Agents work better with more context: project roots, local runtimes, virtual environments, browser profiles, terminal sessions, internal endpoints, deployment notes, credential-loading conventions, tool paths. That context gets written down — in CLAUDE.md, AGENTS.md, copilot-instructions.md, .cursor/rules, agent configs, generated docs, test fixtures, debug reports, MCP configs and helper scripts. Once those files are committed, packed, published or synced, the context crosses a boundary it was never written for.

The paper does not say that every absolute path or private address in public is a leak; a local path is sometimes plain documentation, and topology disclosure is not an exploit. To make the question measurable rather than arguable, it proposes nine context classes and keeps sensitivity and risk as separate axes.

The narrow claim it does make rests on the 2026-09-20 pilot: public AI collaboration files can contain concrete workstation, runtime, session and topology context. The pilot's raw search ratios are not leak rates — search results include forks, templates, tutorials, synthetic examples and duplicates.