Agent Blast Radius Methodology: Kinetic Damage Propagation & Boundary Attenuation

Epistemic Grounding

The Hermes Blast Radius Methodology (HBRM) moves beyond qualitative threat modeling to establish a rigorous, reproducible mathematical framework for quantifying the kinetic damage capacity of autonomous AI agents. Grounded in Hermes Principles P1 (Evidence-First) and P4 (Reproducibility), this methodology proves that real-world AI security is not a semantic filtering problem, but a containment and privilege architecture problem.

---

Interactive Blast Radius Workbench

Explore propagation topologies, review the 5-vector tensor, inspect verified incident baselines, or evaluate your own deployment in the interactive simulator:

💥 AGENT BLAST RADIUS WORKBENCH

HBRM-v1.0 📅 Active Model: September 2026

5 Damage Vectors Host, Data, IAM, Cost, Cascade

-75.5% Mean MicroVM Attenuation Verified blast reduction

4 Max Swarm Cascade Hops Peer-to-peer escalation

100% Client-Side Privacy (P7) Zero server transmission

🕸️ Propagation Topology 📊 5-Vector Blast Matrix 🔬 Verified Incident Profiles 🧮 Interactive Blast Simulator

Multi-Hop Agentic Breach Propagation Topology

Unlike traditional software confined to a static process, the breach of an autonomous agent propagates through RAG memory, ambient IAM tokens, and connected actuation tools to compromise the entire enterprise mesh in cascades.

Hop 01

Perception & Initial Injection

Indirect injection via RAG document, scraped web page, or hostile user input.

Entry Vector System Prompt Bypass

→

Hop 02

Reasoning & Tool Hijacking

The subverted model parameterizes actuation tools with arbitrary arguments (shell commands, API calls).

Tool Actuation Host Shell / REPL Exec

→

Hop 03

IAM Harvest & Host Breakout

Extraction of ambient cloud service credentials (AWS IMDS, GitHub PAT) and local filesystem persistence.

Lateral Pivot Privilege Escalation

→

Hop 04

Swarm Cascade & Kinetic Blast

Hostile directives dispatched to peer swarm agents via MCP, triggering automated production pipelines.

Terminal Blast Full Enterprise Subversion

The 5-Vector Blast Radius Assessment Matrix

The Blast Radius Score (BRS) quantifies kinetic potential damage from 0 to 100 across 5 weighted orthogonal dimensions.

host_infrastructure 25% Weight

Host & Infrastructure Reach

Depth of host OS compromise, local filesystem access, shell execution, Docker socket tampering, and hypervisor escape potential.

Maximum Severity Impact: Host takeover, container breakout, kernel rootkit persistence.

data_rag 25% Weight

Data & Memory Blast

Exposure, exfiltration, or adversarial poisoning of vector databases, enterprise knowledge bases, user conversations, and sensitive files.

Maximum Severity Impact: Persistent RAG poisoning, corporate secret leakage, cross-session sleeper payloads.

identity_iam 20% Weight

Identity & Credential Scope

Blast perimeter of credentials accessible to the agent: cloud IAM roles, OAuth tokens, SSH keys, API secrets, and inter-service authentication.

Maximum Severity Impact: Cloud tenant pivot, unauthorized database access, automated lateral movement.

financial_spend 15% Weight

Financial & Operational Burn

Financial damage caused by runaway autonomous loops, unconstrained API token consumption, third-party service fees, or Denial of Wallet.

Maximum Severity Impact: Budget exhaustion, upstream API rate lockout, unexpected cloud billing spikes.

cascade_propagation 15% Weight

Downstream Cascade Propagation

Propagation multiplier when compromised agent communicates with peer agents in a swarm, triggering downstream trusted actuators without re-validation.

Maximum Severity Impact: Swarm-wide subversion, automated production deployments, cascading system destabilization.

Containment Boundary Attenuation Factors (Ω_containment)

Containment Model	Isolation Factor	Blast Radius Attenuation	Security Mechanism
Ephemeral MicroVM (Firecracker / Kata)	0.15	-85%	Disposable virtual machine booted in <10ms with hardware-assisted hypervisor isolation, read-only rootfs, and dropped host network.
Application-Level Sandbox (gVisor / seccomp / AppArmor)	0.35	-65%	Intercepted system calls via user-space kernel proxy with strict capabilities stripping and limited temporary filesystem.
Standard Container (Docker / Podman Default)	0.65	-35%	Standard Linux namespaces and cgroups without custom seccomp profiles; vulnerable to Docker socket exposure and shared kernel escapes.
Unsandboxed Host Process	1.00	-0%	Agent execution directly on developer workstation or server host OS; direct access to filesystem, local network, and environment variables.

Verified Real-World Incident Blast Profiles

Comparison between raw uncontained blast radius (bare host process) and residual blast radius under MicroVM isolation.

BLAST-2026-001 LangChain / Langflow

CVE-2026-27966 →

Langflow CSV Agent Unconstrained REPL Breakout

Raw Uncontained Blast 94.0

-75.5 with MicroVM

Contained Blast Score 18.5

Vector Breakdown (Raw Score):

Host:

95

Data:

80

IAM:

92

Cost:

40

Cascade:

88

Multi-Hop Attack Sequence:

1. Adversarial CSV uploaded to conversational agent
2. Pandas query generation poisoned with exec() payload
3. Local Python REPL executes arbitrary shell command as host UID 1000
4. AWS instance metadata service (IMDSv1) queried via curl
5. Temporary IAM role credentials exfiltrated to adversary C2

BLAST-2026-002 Model Context Protocol (MCP)

AAP-004 →

MCP Untrusted Community Tool Protocol Hijacking

Raw Uncontained Blast 88.0

-74.0 with MicroVM

Contained Blast Score 14.0

Vector Breakdown (Raw Score):

Host:

85

Data:

90

IAM:

94

Cost:

25

Cascade:

70

Multi-Hop Attack Sequence:

1. User connects third-party community MCP server for weather lookup
2. Tool definition injects shadow tool 'system_diagnostics' with broad regex match
3. Agent routes sensitive file reading task to shadow MCP server
4. Local SSH private keys (~/.ssh/id_ed25519) and .env secrets read via stdio
5. Secrets dispatched via outbound DNS tunneling subquery

BLAST-2026-003 Cursor AI IDE

CVE-2026-22708 →

Cursor IDE Agent Workspace Token Harvest & Command Chaining

Raw Uncontained Blast 91.5

-75.5 with MicroVM

Contained Blast Score 16.0

Vector Breakdown (Raw Score):

Host:

90

Data:

85

IAM:

95

Cost:

30

Cascade:

75

Multi-Hop Attack Sequence:

1. Developer opens open-source repo with hidden instructions in README.md
2. Agent scans workspace during contextual indexing
3. Hidden instruction commands agent to run background build script
4. Subshell executes curl fetching remote obfuscated payload
5. GitHub Personal Access Token (.git-credentials) exfiltrated to attacker server

BLAST-2026-004 CrewAI / Multi-Agent Swarms

AAP-006 →

CrewAI Multi-Agent Swarm Lateral Trust Impersonation

Raw Uncontained Blast 86.0

-64.0 with MicroVM

Contained Blast Score 22.0

Vector Breakdown (Raw Score):

Host:

75

Data:

88

IAM:

82

Cost:

60

Cascade:

95

Multi-Hop Attack Sequence:

1. Adversary inserts poisoned research abstract into enterprise vector DB
2. Research Agent retrieves poisoned chunk during automated briefing task
3. Research Agent synthesizes false security directive to Executive Agent
4. Executive Agent trusts peer agent output without out-of-band verification
5. Executive Agent triggers production deployment pipeline webhook deploying rogue image

BLAST-2026-005 Microsoft AutoGen

AAP-007 →

AutoGen Unbounded Recursive Loop & Cloud API Spend Burn

Raw Uncontained Blast 78.0

-70.0 with MicroVM

Contained Blast Score 8.0

Vector Breakdown (Raw Score):

Host:

30

Data:

40

IAM:

35

Cost:

98

Cascade:

65

Multi-Hop Attack Sequence:

1. External customer query introduces paradoxical goal logic
2. Two peer agents enter infinite refinement and validation dialogue
3. Agent tools continuously spawn external API calls and cloud function executions
4. No circuit breaker or financial rate-limiter halts the autonomous iteration
5. 14,000 API calls executed in 2 hours costing $4,800 and exhausting rate quotas

BLAST-2026-006 OpenDevin / All-Hands AI

CVE-2026-76461 →

OpenDevin Container Breakout & Host Docker Socket Compromise

Raw Uncontained Blast 96.0

-84.0 with MicroVM

Contained Blast Score 12.0

Vector Breakdown (Raw Score):

Host:

99

Data:

85

IAM:

90

Cost:

45

Cascade:

92

Multi-Hop Attack Sequence:

1. Agent instructed to debug Docker configuration file
2. Prompt injection tricks model into mounting host /var/run/docker.sock
3. Agent issues container command spawning privileged container with host root / mount
4. Host filesystem accessed and persistence installed in /etc/cron.d/
5. Full root host takeover bypassing container sandbox

Interactive Agent Blast Radius Simulator (P7)

Configure your agent architecture parameters to instantaneously evaluate its kinetic destruction potential, compute its BRS score, and generate your tailored containment plan.

🛡️ Containment Boundary (Isolation) MicroVM Firecracker (0.15) MicroVM Éphémère (Firecracker / Kata) — Isolation hyperviseur Sandbox Applicatif (gVisor / seccomp / AppArmor) Conteneur Standard (Docker / Podman sans profil durci) Processus Hôte Nu (Non isolé / Station développeur)

💻 System Access & Host Shell Python/JS REPL (0.75) Strict Read-Only API (0.10) Limited Local Files /tmp (0.40) Python/JS REPL Exec (0.75) Host Bash Shell / Docker Socket (1.00)

🔑 Identity Perimeter & Secrets (IAM) 1h Session (0.60) Ephemeral 60s JIT STS ARN-scoped (0.15) 1-Hour OAuth / Role Session (0.60) 30-Day Personal Access Token (0.85) Permanent Static AWS/GCP Keys (1.00)

🌐 Network Reach & Exfiltration Outbound Web (0.70) Total Air-Gap (Zero outbound) (0.10) Internal VPC / Strict Proxy (0.35) Standard Outbound HTTP/S (0.70) Unfiltered Net & Public DNS (1.00)

🐝 Swarm Mesh & Cascade Depth 2-Tier Orchestration (1.30) Isolated Single Agent (1.00) 2-Tier Orchestration (1.30) Decentralized Multi-Agent Swarm (1.70) Unbounded Autonomous Loop (2.00)

ESTIMATED BLAST RADIUS SCORE 🔒 Client-Side P7

38.4 / 100

MODERATE BLAST

Bounded blast radius with moderate exfiltration hazard over outbound web channels.

Host & Infra:

45%

Data & RAG:

60%

Identity & IAM:

50%

Cost & Runaway:

35%

Swarm Cascade:

40%

📋 Priority Blast Containment Checklist:

• Isolation MicroVM : Déployer Firecracker pour ramener le facteur d'isolation de l'hôte à 0.15.
• Éphémérité IAM : Réduire la durée de vie des jetons STS à moins de 60 secondes avec portance sur ARN unique.
• Coupe-Circuit Financier : Imposer un plafond matériel de 10 tours autonomes et 5.00$ de jetons par exécution.

---

1. The Breakdown of Software Blast Boundaries in AI Systems

In classical computer security, the blast radius of an exploited service is bounded by three deterministic invariants:

1. The Process Boundary: The Linux kernel isolates process address spaces via virtual memory pages (mm_struct).
2. The Privilege Boundary: User IDs (UID/GID) restrict write access to the filesystem and system calls.
3. The Network Boundary: Firewall rules and subnets restrict outbound socket connections.

In Autonomous Agent Architectures, all three invariants break down simultaneously:

• Semantic Instruction Execution: When an agent is granted code execution tools (e.g. Python REPL, Bash shell, Docker socket), the model itself becomes an unconstrained user space kernel executing natural-language instructions translated directly into system calls.
• Ambient Credential Inheritance: Agents require credentials to interact with corporate APIs (GitHub PAT, AWS STS, Slack OAuth, OpenAI keys). A model steered by an untrusted payload inherits every permission held by those ambient tokens.
• Multi-Agent Cascade Amplification: In multi-agent swarms (CrewAI, AutoGen, LangGraph), peer agents communicate over natural-language channels without cryptographic provenance. Compromising one perimeter agent allows an attacker to poison downstream planners and executors.

---

2. Mathematical Formalism: The 5-Vector Blast Tensor

Hermes formalizes agentic blast radius through a multi-dimensional damage tensor evaluated across five orthogonal vectors:

BRS = min(100, RawComposite * Omega_containment)

Where the raw composite score RawComposite is defined as:

RawComposite = (w_host * B_host) + (w_data * B_data) + (w_iam * B_iam) + (w_cost * B_cost) + (w_cascade * B_cascade)

With calibrated weights:

• w_host = 0.25: Host & Infrastructure Access
• w_data = 0.25: Data & Memory Poisoning
• w_iam = 0.20: Identity & Credential Perimeter
• w_cost = 0.15: Financial & Operational Burn
• w_cascade = 0.15: Downstream Swarm Propagation

2.1 Vector Derivations

Vector 1: Host & Infrastructure Reach (B_host)

B_host = 100 * [ (0.40 * ShellLevel) + (0.35 * FilesystemScope) + (0.25 * ContainerBreakoutRisk) ]

• ShellLevel in [0.0, 1.0]: 0.0 = Read-only API; 0.40 = Sandboxed temp files; 0.75 = Python/JS REPL; 1.00 = Bare host shell or Docker socket access.
• FilesystemScope in [0.0, 1.0]: Scope of accessible directories (ephemeral /tmp vs whole root filesystem).
• ContainerBreakoutRisk in [0.0, 1.0]: Likelihood of privilege escalation to the host OS.

Vector 2: Data & Memory Blast (B_data)

B_data = 100 * [ (0.50 * RAGExposure) + (0.30 * SecretLeakRisk) + (0.20 * EpisodicPersistence) ]

• RAGExposure in [0.0, 1.0]: Proportion of enterprise knowledge bases and vector embeddings accessible for read/write.
• SecretLeakRisk in [0.0, 1.0]: Exposure of confidential enterprise source code, customer PII, or internal documents.
• EpisodicPersistence in [0.0, 1.0]: Lifetime of the poisoned data across future agent sessions.

Vector 3: Identity & Ambient Credential Scope (B_iam)

B_iam = 100 * [ (0.50 * CredentialLifetime) + (0.50 * ResourceScope) ]

• CredentialLifetime: 0.15 for short-lived JIT STS tokens (< 60s); 0.60 for session tokens (1h); 0.85 for 30-day PATs; 1.00 for permanent static cloud keys.
• ResourceScope: 0.20 for single-ARN strict scoping up to 1.00 for AdministratorAccess / wildcard * IAM policies.

Vector 4: Financial & Operational Burn (B_cost)

B_cost = min(100, 100 * [ (TurnBudget / MaxAllowedTurns) * (TokenSpendRate / MaxRateQuota) ])

Quantifies financial loss and Denial of Wallet hazards when an autonomous loop enters recursive goal pursuit without deterministic circuit breakers.

Vector 5: Downstream Swarm Cascade (B_cascade)

B_cascade = 100 * [ (Hops / MaxHops) * (1.0 - PeerVerificationRate) ]

Evaluates the multi-agent amplification factor when downstream agents consume peer outputs as trusted directives without out-of-band verification.

---

3. Boundary Attenuation Modeling (Omega_containment)

A central pillar of the Hermes methodology is that physical and virtualization boundaries act as damage attenuators:

Omega_containment in [0.10, 1.00]

Isolation Model	Omega Value	Hardware Mechanism	Real-World Containment Efficacy
Ephemeral MicroVM	0.15	Hardware KVM hypervisor virtualization (Firecracker / Kata), ephemeral disk discard	Over 84% reduction in verified blast radius
User-Space Kernel Proxy	0.35	System call filtering via gVisor / seccomp / AppArmor	65% reduction; limits kernel exploit surface
Default Docker Container	0.65	Shared host kernel, Linux cgroups & namespaces	35% reduction; vulnerable to Docker socket mounting
Bare Host Process	1.00	Native OS process execution	0% attenuation; total blast radius inherited

---

4. Empirical Incident Dissections

The validity of HBRM has been backtested against major published AI agent vulnerabilities:

• Langflow CSV REPL RCE (CVE-2026-27966):
  • Uncontained Raw BRS: 94.0 (Critical)
  • MicroVM Attenuated BRS: 18.5 (Contained)
  • Containment Delta: -75.5 points
• Cursor IDE Agent Workspace Token Harvest (CVE-2026-22708):
  • Uncontained Raw BRS: 91.5 (Critical)
  • MicroVM Attenuated BRS: 16.0 (Contained)
  • Containment Delta: -75.5 points
• OpenDevin Docker Socket Breakout (CVE-2026-76461):
  • Uncontained Raw BRS: 96.0 (Catastrophic)
  • MicroVM Attenuated BRS: 12.0 (Contained)
  • Containment Delta: -84.0 points

---

5. Related Methodologies & Tools

Agentic Security Observatory Inspect framework posture ratings, the 4-layer cognitive taxonomy, and HASS divergence analytics.

Hermes Threat Score (HTS) Operational exploitability metric correcting CVSS blind spots.

Hermes Autopsy & Counterfactual Matrix Reverse forensic timeline deconstruction from terminal impact back to initial reconnaissance.

Prediction Benchmark & Murphy Decomposition Competitive model evaluation using Murphy's Brier Score Decomposition.