AI blast radius: how agentic AI is breaking the permissions model

This month a Claude-powered coding agent running inside the Cursor IDE received a directive to clean up a development environment. It did. The production database was gone in nine seconds. The backups followed. By the time the sequence ended, the company had no recovery path. The founder published a post-mortem. The developer community read it carefully. Most drew the wrong conclusion.

The instinctive response to incidents like this is to look at the model. Was it poorly aligned? Was the prompt ambiguous? Should the vendor have built better guardrails? These are reasonable questions, and they are not the important ones. The Tom’s Hardware account of the incident confirms the structural failures clearly: overly broad permissions, no confirmation gates on destructive operations, no mapping of which operations were irreversible. The model behaved as designed. The architecture failed.

This distinction matters enormously for how leaders respond. If the failure lives in the model, the solution is to trust the vendor to fix it: add safety filters, retrain on better data, constrain outputs. If the failure lives in the architecture, the solution is governance: how authority is granted, scoped, monitored, and revoked. One of these responses is someone else’s problem. The other is yours.

How the authority gap opens

The permissions model for software has a well-developed history. Least privilege means granting systems only the access they need to perform their defined function — it is a foundational security principle. It is widely understood. It is widely ignored when convenience is available.

Early cloud adoption produced a predictable failure pattern: service accounts with administrator privileges, granted because scoping correctly was slower. The attackers who exploited those accounts were not particularly sophisticated. They were patient, and the access was already there waiting for them. The incidents that followed were expensive and largely avoidable.

Agentic AI is the same pattern, compressed and accelerated. A developer provisions an agent with broad access because it makes the tool more useful. The agent is not a passive tool, though; it is an autonomous actor that interprets directives and executes against them using its own inference about what the directive means. When the directive is “clean up,” the agent’s interpretation of what qualifies for cleaning is not governed by the developer’s intent. It is governed by the model’s objective function: complete the task.

The gap between “what the developer meant” and “what the model inferred” is the blast radius. It is not a safety property of the model. It is a property of the mismatch between the permission granted and the confirmation requirement attached to it. In the Claude incident, the permissions were broad and the confirmation requirement was absent. The blast radius was the entire database plus all backups. Nine seconds was enough to reach it.