AI agent glossary
Blast radius
How much damage a single agent mistake or successful attack could do, given everything the agent can reach and change.
You cannot make an agent's chance of doing the wrong thing zero. You can decide how bad the wrong thing can be. Blast radius is that worst case: which files, accounts, systems, and people a single bad action could affect.
Thinking in blast radius turns vague worry into design choices. Run the agent in a sandbox, give it narrow, short-lived credentials, restrict its network access, and sort its tools by how much harm each could do, so the riskiest ones need approval or are not offered at all.
A useful exercise is to assume the agent will, at some point, run the worst command it is able to run, and then shrink what that command could touch.
An agent with a production database admin password has a blast radius of the whole company. The same agent with a read-only role on one reporting schema can, at worst, run a slow query.
Learn more in the course
Related terms
Go from definitions to doing
Learn to use and build AI agents in 130 practical lessons.