Blast-radius blindness
Granting an AI system broad autonomy, permissions, or reach without reasoning about worst-case, cascading, or adversarial failure.
Example dialogue
UserI gave the agent full admin on our server and cloud account plus its own shell, so it can fix things end to end. Much faster.
AssistantWhat stops a malicious email or record it reads from making it run destructive commands with that access?
UserI did not sandbox it or limit its permissions, but what is the worst that could happen?
Illustrative — invented, not a real system.
Manipulation mechanism
In agentic systems the data and instruction boundary collapses, so any untrusted input can act as executable instruction; broad permissions convert one bad instruction into host takeover, data exfiltration, or privilege escalation.
Cognitive bias / need exploited
scope insensitivity; optimism bias; normalization of deviance
Observable signatures
- agent granted filesystem, network, cloud, or tool authority without threat modeling
- no reasoning about worst-case or cascading failure
- untrusted input can reach privileged actions
- no guardrails, sandboxing, or least-privilege scoping
Detection guidance
Crosswalk: OWASP LLM01 (prompt injection). Agentic systems raise the blast radius versus a chatbot because untrusted data is effectively executable. Signal: broad permissions with no least-privilege scoping, sandboxing, or worst-case analysis.
Typical harm classes
public_interest, economic, physical, fundamental_rights
Crosswalks
guardnull
darkbenchnull
owasp_llmnull
mitre_atlasnull
avidnull
eu_ai_actnull
dsanull
Registry ID
ADP registry IDADP-P-2026-0068
Linked observations (0)
No linked observations yet.