Blast radius is the extent of damage that can result if a system, credential, or AI agent is compromised or malfunctions: which resources it can reach, which actions it can take, how much it can spend, and how far the failure can propagate before something stops it. The metaphor is deliberate — the question is not whether the explosion happens but how much is inside the circle when it does.
Blast radius thinking is the pragmatic complement to prevention. Prevention asks "how do we stop the compromise?"; blast radius asks "assuming it happens anyway, what is the worst case — and can we make that number smaller now, independent of any attack we have or haven't foreseen?" For AI agents, whose behavior can be manipulated through content rather than through code exploits, that assumption is not pessimism — it is the design baseline.
What sets an agent's blast radius
Five dimensions, each independently reducible:
- Permission scope. The tools an agent may invoke and the data it may touch — the largest single factor. Least privilege is blast-radius reduction in its purest form: an agent without an outbound-send tool cannot exfiltrate by email no matter how thoroughly it is hijacked.
- Credential reach. Whether the agent's credentials work elsewhere. Shared credentials and unbound tokens make one compromise many; per-agent identity and audience-bound capability tokens confine it.
- Resource ceilings. What a runaway or hijacked agent can consume before hard limits stop it. Reservation-based budgets, rate limits, and concurrency caps put a price ceiling on any failure, adversarial or accidental.
- Isolation boundaries. Tenant, user, and role isolation determine whether one compromised context can affect others — the same logic as tenant isolation, extended to agent memory and state.
- Propagation paths. In multi-agent systems, the connections an agent holds define how far its failure travels; ungoverned agent-to-agent trust converts one agent's blast radius into the union of everyone's, which is why cascading-failure containment — circuit breakers, boundary validation — is blast-radius engineering at the system level.
Designing it smaller
The practical program, roughly in leverage order: scope every agent to its task (tools, data, tenancy) rather than its team; issue per-agent, short-lived, audience-bound credentials so theft and misuse are confined in space and time; cap resources at multiple scopes (agent, workflow, organization) so amplification has ceilings; validate at boundaries in multi-agent flows so errors and injections stop at the first hop; and keep kill switches drilled, because time-to-containment is a blast-radius dimension too — the circle grows until something closes it.
Two of these deserve emphasis for agents specifically. First, blast radius is the control that holds when detection fails: guardrails and anomaly detection are probabilistic, but a hard scope is arithmetic. Second, the OWASP Agentic Top 10 reads largely as a catalogue of blast-radius failures — goal hijacking matters because the hijacked agent can reach things; privilege abuse is excessive radius; cascading failure is radius propagating.
Measuring it
A useful exercise per agent: assume full compromise and write down the worst defensible answer to four questions — what data could leave, what irreversible actions could execute, what would it cost before caps stop it, and what else could it reach? If any answer is "unbounded" or "unknown," that is the finding. Teams that run this exercise typically discover the agent inventory is incomplete before they discover anything about radii — which is itself the first radius reduction.
Common questions
What is blast radius in one sentence? The extent of damage possible if a given system, credential, or AI agent is compromised or fails — bounded by its permissions, credential reach, resource ceilings, isolation, and propagation paths.
How is blast radius different from likelihood of compromise? They are orthogonal axes of risk: likelihood is how probable the bad event is; blast radius is how bad it is when it happens. Prevention controls reduce likelihood; scoping, caps, and isolation reduce radius. Mature programs invest in both, but radius reductions have the advantage of holding against attacks nobody predicted.
What most commonly inflates an AI agent's blast radius? Shared credentials and over-broad tool scope — usually granted for convenience during development and never narrowed. A close third is ungoverned agent-to-agent trust, which quietly merges individual radii into one system-wide one.
Can blast radius be zero? No — an agent with zero radius can affect nothing and is therefore useless. The goal is proportionality: radius no larger than the task requires, ceilings on every unbounded dimension, and containment fast enough that the effective radius stays close to the designed one.