Research environments were early adopters of agents and the last to get an identity model for them. The same researchers building with Claude and Copilot are quietly creating a new attack surface.