What can your AI agent actually destroy?
Paste an agent's IAM policy, tool list, or config and get its blast radius — exactly what it can delete, exfiltrate, spend, or execute if it misbehaves or gets compromised. Every check runs on your device.
What "blast radius" means for an AI agent
When you hand an AI agent credentials and tools, you're defining the worst thing it can do — on its best day and its worst. The agent that can read a metric is a rounding error. The agent that holds a wildcard IAM policy and a run_shell tool can delete your database, read every secret, and spend your money — and it will, the one time it reasons its way into a bad plan. Blast radius is that worst case, made explicit.
The capabilities that widen it most
- Unbounded scope —
Action: "*",AdministratorAccess, or*:*. The single most dangerous setting: it grants every other capability at once. - Destroy data — delete/drop/truncate,
rm -rf,s3:Delete*, terminate instances. - Exfiltrate secrets — read secrets managers, decrypt with KMS, read
.envor credentials. - Move money — refunds, payouts, transfers, charges.
- Execute code — shell,
exec,eval, subprocess, arbitrary command runners.
How to shrink it
Scope to least privilege (kill wildcards and admin), strip destructive and financial tools the agent doesn't strictly need, never hand it raw production credentials or a shell, and put a control plane between the agent and consequential actions. Apply the approval mode appropriate to the task, record what runs, and validate recovery options for each service.
This maps the blast radius. Infraveil contains it.
Infraveil is a backend operations platform for software on servers you control. Agents can act through scoped credentials and configured approval modes, with operational records and recovery controls. The blast radius you mapped becomes a set of risks you can reduce, monitor, and verify.
See the live demo →Frequently asked questions
What is an AI agent's blast radius?
The worst-case damage it can do if it misbehaves or is compromised — everything its permissions and tools allow: delete data, read secrets, move money, execute code. This tool scores it.
How do I reduce it?
Least privilege (no wildcards/admin), remove tools it doesn't need, no raw prod creds or shell, and gate destructive/production-changing actions behind human approval. That's what Infraveil does →
Is it safe to paste my IAM policy?
Yes — everything runs in your browser. Nothing is uploaded or logged; it works offline.
What's the most dangerous single permission?
A wildcard Action: "*" / AdministratorAccess — it grants delete, secret-read, spend, and execute all at once. Paired with shell access, it's the setup behind most AI-agent-wrecked-prod incidents.