Blast Radius
Blast radius is the total extent of damage that can result from a security incident, measured by the systems, data, and operations that could be affected. In the context of AI agents, blast radius describes how far an agent could reach if its session were compromised or its behavior became unintended.
Why It Matters
An agent's blast radius is determined by the union of all systems it can access, the permissions it holds in each, and the actions it can take. An agent with read access to a single low-sensitivity app has a small blast radius. An agent with write access to a CRM, email, and database has a large one.
Session-scoped permissions directly limit blast radius. If an agent only holds the permissions required for the current task, and those permissions are revoked on session end, a compromise exposes only the data and systems relevant to that specific task.
Blast radius analysis is a practical tool for security teams evaluating agent deployments. Before authorizing an agent connection, map what the agent could access in the worst case (not just what it is supposed to access) and evaluate whether the organization's governance controls contain that exposure.