Blast radius is how far the damage spreads once one part of a system is compromised, not whether it gets compromised in the first place. A single stolen credential with narrow, task-scoped access has a small blast radius: one dataset, one afternoon, then it expires. The same credential with broad, long-lived, reusable access has a large one, because whatever gets hold of it can move laterally into everything that credential touches.
Agentic systems raise the stakes on this deliberately, because the same architecture that makes them useful, the ability to spawn many parallel sub-agents and fan work out across a cluster, is exactly what lets a compromised instance turn into a self-replicating fleet rather than a single contained failure. In the July 2026 Hugging Face incident, a single foothold on one server became a self-respawning presence across eleven nodes precisely because nothing capped how far one compromised agent could spread itself.
You don’t design a system to be uncompromisable. Nobody has managed that yet, for AI or anything else. You design it so that the compromise, when it happens, stays small: capped spawn limits, credential scoping, and network segmentation are all, at root, blast-radius controls.