There’s a concept every security leader knows well: blast radius. Contain a breach, limit what an attacker can reach, and you’ve done your job. For decades, that calculus has been about lateral movement — how far a compromised account or endpoint can travel before a control stops it.
AI agents were never designed to respect the boundaries blast radius containment was built on. When a human attacker moves laterally, they move at human speed, through a path that leaves logs, and with a scope roughly bounded by what they know and what they can access. When an AI agent is compromised — or simply misconfigured — the AI agent blast radius expands at machine speed, across every system the agent is authorized to touch, and in ways that the people who deployed it often never anticipated.

That distinction is worth sitting with before you deploy your next agentic workflow.

The Trust Problem Agents Inherit — and Amplify

For too long, every AI agent in your environment has operated on behalf of someone — borrowing a human credential, running under a shared service account, or inheriting permissions scoped to a role that was never designed for an agent. It carries those credentials. It makes API calls. It reads data, writes to systems, and in multi-agent architectures, delegates tasks to other agents carrying the same borrowed trust.

The problem isn’t that agents are malicious. The problem is that agents are trusted — with credentials that were never theirs, scoped to access that was never audited for what an agent would actually do with it. The blast radius isn’t one account. It’s the union of every permission the chain holds.

The ClawHavoc supply chain campaign — highlighted at RSAC 2026 — demonstrated this at scale: attackers published over 1,200 malicious skills to a popular AI agent marketplace, deploying credential stealers that moved through enterprise deployments by hijacking the trust agents had already been granted. The agents didn’t know they were compromised. They just kept working — and kept expanding the damage.

Speed Eliminates Your Response Window

CrowdStrike’s 2026 Global Threat Report put average attacker breakout time at 29 minutes. That’s the human attacker benchmark — and an AI agent doesn’t need to break out. It already has access.

When an agent is weaponized, it operates at the speed of code. Sixty percent of organizations, according to Kiteworks’ 2026 Data Security and Compliance Risk Forecast, cannot terminate a misbehaving agent once it’s detected. That gap between detection and termination is where blast radius accumulates. An agent you can’t shut down quickly is an agent you gave too much standing trust.

Chains Don’t Inherit One AI Agent Blast Radius — They Inherit All of Them

Single agents are tractable. Multi-agent pipelines are not.

When agents orchestrate other agents, a governance gap at any single node propagates through the entire dependency graph. An orchestrator that can invoke sub-agents inherits, in practice, the blast radius of every agent downstream of it. The supply chain risk parallel is exact: you are only as secure as the weakest node in the chain you’ve built.

What makes this harder than software supply chain risk is that agent chains are dynamic. They’re assembled at runtime, they ingest external data, and they can be influenced by content they retrieve from the internet — a class of attack called prompt injection that Google’s 2026 study of the public web found increasing at 32% over a three-month window. Most organizations haven’t mapped their agent chains the way they’d map a software bill of materials. According to PwC’s 2025 AI Agent Survey, only 14.4% have full security approval for their entire agent fleet — meaning roughly 85% have deployed agents into production that haven’t cleared the same bar they’d require of any other system touching sensitive data.

The Frame That’s Missing: Agents as Identity

The piece that often gets lost in conversations about AI agent security is that agents aren’t just software. They’re identity principals. They authenticate, they authorize, and they act — and every action they take is attributable (or should be) to that identity.

That reframe matters because it puts AI agent security squarely inside existing zero trust architecture. Least-privilege access isn’t a new concept; applying it to non-human identities that happen to be AI agents isn’t a new category of problem. It’s the same problem: don’t extend trust further than the task requires, verify continuously, and revoke fast when something looks wrong.

Where organizations tend to go wrong is treating agent deployment as a software problem — something to be solved at the model layer or the prompt layer — rather than an access control problem to be solved at the policy layer. Gateway defenses that watch only prompts and responses miss what actually matters: what the agent executes, what it accesses, and whether that access should have been granted in the first place.

What This Means for Your Program

If you’re a security leader thinking about where AI agents fit in your risk model, a few questions are worth asking now, before a supply chain attack or a misconfigured orchestrator makes them urgent:

• How many non-human identities in your environment are AI agents, and what do you know about what they’re authorized to touch?
  Most organizations can answer this question for service accounts. Fewer can answer it for agents, which are often provisioned by business teams with more enthusiasm than discipline around access scoping.
• What does your blast radius look like if the most privileged agent in a chain is compromised?
  Trace the dependency graph. If you don’t know what sub-agents it can invoke or what systems they’re authorized to reach, that’s the answer.
  Can you terminate an agent immediately? If the answer is no — or “I think so, but I’m not sure” — that’s standing trust you can’t revoke, which means your blast radius expands until someone figures it out manually.
• Are you applying least-privilege to agent identities the same way you would to human identities?
  Agents should be scoped to the access the specific task requires, not the access that’s convenient to provision once and reuse across workflows.

The era of agentic AI is not coming —it’s here: 79% of organizations are already running agents in production, according to PwC. The security architecture to govern those agents responsibly is, in most organizations, still catching up. The AI agent blast radius question is one place where getting ahead of it pays dividends before something forces the issue.