Failure Blast Radius

Failure Blast Radius is the measure of how much damage a single unmonitored AI action can do before a human notices. It scales with three variables: how many systems the agent can touch, how long it runs unsupervised, and how reversible its actions are. A prompt that drafts copy has a blast radius of one document; an agent with CRM write access and payment credentials has a blast radius of the client's revenue. Agencies should size evaluation spend against blast radius, not against model spend. The clearest recent case: a single hacker used largely autonomous agents to compromise more than 100 websites, with confirmed victims including John Deere and SharkNinja. That is blast radius without a human in the loop. For retainer clients, the practical move is to classify every deployed agent by blast radius, then require tracing and rollback gates proportional to that rating before anything reaches production.