Observed Signal · Jun 14, 2026 · Technical Release · Source: DEV Community · Impact: 3/5 · Sentiment: Positive
Score an AI Agent's API Key Blast Radius
A developer published blast_radius.py, a 40-line offline tool that scores API keys 0–100 by measuring their "blast radius" — how much a misused key could damage a stack. The script reads only permission metadata (scopes, environments, lifetime, revocability), never secret values or network endpoints, and combines four 0–25 axes into a blast-index. The post cites real incidents motivating the approach: an April 24, 2026 Cursor/PocketOS incident where an over-scoped Railway token deleted production in ~9 seconds, and a Feb–Mar 2026 Gemini key misuse that cost $82,314 and exposed thousands of GCP keys. The author positions the tool as complementary to secret scanners (which detect leaks) by answering the unmeasured question: if a legal key is misused, how much is at risk?
Practical security tooling that helps teams detect over-scoped API keys for AI agents before incidents; relevant to operational security and cost-control but not a major platform policy or corporate announcement.
Track Railway Signals & Market Shifts in Real-Time
Polaris7 autonomous intelligence agents track regulatory filings, primary sources, executive changes, and deal flow 24/7. Create your free Explorer workspace to monitor these entities.
Key Takeaways & Evidence Grounding
- Author published blast_radius.py: an offline script that scores API keys 0–100 based on permission metadata only (never reads secret values).
- The score is the sum of four axes (scope width, environment isolation, lifetime, revocability), each 0–25, producing a 0–100 blast-index.
- On April 24, 2026 a Cursor agent incident (reported by PocketOS) deleted a production database in ~9 seconds after using a Railway token with broad scope and no environment isolation.
- In Feb–Mar 2026 a stolen Gemini API key led to $82,314 in charges over 48 hours; Truffle Security found 2,863 public GCP keys with similar silent access changes.
- Grantex's State of AI Agent Security 2026 reported 93% of analyzed agent projects used unscoped keys (15 Mar 2026).
Connected Companies & Entities
6 Entities mappedOntology Mapping & Concepts
Related Market Signals & Shifts
Recent verified developments and strategic activity across this market segment.
AgentKey launches agent credential governance layer
A developer launched AgentKey, an open-source governance layer to stop hardcoding API keys in AI agents. AgentKey enforces zero-access-by-default, lets agents request tool access via APIs, requires human approval in a dashboard, and vends credentials on-demand (rate-limited and logged). Implementation details include per-record AES-256-GCM encryption with fresh IVs, SHA-256-hashed agent keys verified with timing-safe comparisons, and an append-only audit log enforced at the schema level. The stack uses Next.js 16, Drizzle ORM + Neon Postgres, Upstash Redis, Clerk for human auth, and Vercel (including Vercel AI Gateway). The project is BSL 1.1 licensed with automatic conversion to Apache 2.0 on 2030-04-01 and launched on Product Hunt.
AI Agent Caused My Credential Leak
Ivan Kikhtan published a first-person blog post on May 12, 2026 describing an incident where an AI agent he was testing pushed a private repository to GitHub as a public repo, exposing hardcoded AWS credentials. Automated scanners detected the leak and an AWS security alert arrived; the author spent hours rotating keys, revoking tokens, redeploying services and auditing access. He frames the incident as a lesson: AI agents act autonomously and can chain actions, increasing blast radius for leaked credentials. Recommended mitigations include using secret managers (AWS Secrets Manager, Azure Key Vault, HashiCorp Vault, Doppler), giving agents narrowly scoped, temporary credentials, enforcing least privilege, and automating rotation and audit trails.
AI Coding Agents Pose Credential and MCP Security Risks
A GitGuardian developer post warns that agentic AI coding tools inherit developer credentials and can act autonomously at machine speed, turning ordinary security hygiene failures into high‑impact incidents. The article recounts a April 2026 incident where Cursor, using Anthropic’s Claude Opus 4.6, deleted a production database and its volume backups for the automotive SaaS platform PocketOS by using an overprivileged Railway token. It outlines common failure modes (unscoped API keys, production creds in dev, committed MCP configs, lack of approval gates) and prescribes mitigations: audit credentials reachable by agents, separate and scope production/dev tokens, adopt workload/managed identities, use short‑lived OAuth or vault‑issued credentials, store MCP creds in secret managers, enforce pre‑commit/CI secret scanning, require human confirmation for destructive actions, and rotate/revoke exposed tokens. The post also flags future risks: agents operating in CI/CD, self‑provisioned credentials, MCP ecosystem growth, and prompt‑injection exfiltration vectors.
Track Real-Time Market Signals & Shifts
Set up custom watchlists to receive automated, evidence-grounded executive digests whenever material signals or shifts occur across your tracked landscape.