Research
SquireX Research
Working papers on how AI agents get their capabilities, and how those capabilities leak. Public editions describe patterns; case details stay private until maintainers have been notified.
Agent capabilities leak through the software supply chain
Committed samples, metadata, and coding-agent settings hand the next org a grant the author treated as demo scaffolding. Clone is install. Install is the grant. A twelve-class taxonomy, why file scanners stop short, what to change, and a reader check you can run today.
Read the paper →