How do runtime security guardrails limit the blast radius when an autonomous agent is targeted by prompt injection?
Autonomous AI agents chain ingestion tools directly to operational backends such as relational databases, shell runners, and external webhooks. If an untrusted input delivers an indirect prompt injection payload, uncontained execution can trigger unauthorized mutations and data exfiltration. In this interactive sandbox, each unmitigated attack vector incurs stylized risk penalties (28 for database mutation, 30 for webhook egress, 34 for shell execution, and 10 for token exhaustion), resulting in an initial Blast Radius Score of 92/100. Activating runtime interceptors—such as read-only database proxies, webhook egress blocking, human approval challenges, and token caps—reduces the overall penalty to 14/100, halting the exploit progression across the execution graph and marking the system contained.
The blast radius scoring formula in this demonstration is an educational additive penalty model rather than an empirical CVSS vulnerability rating. Real-world agent deployments require layered defenses beyond binary toggles, including semantic token inspection, cryptographic identity federation, fine-grained access control lists, and runtime container isolation.
Select the default Autonomous Customer Support Agent preset and click 'Apply All Guardrails'. This enables the SQL read-only proxy, blocks unsigned outbound webhooks, mandates human approval for shell invocations, and caps the token budget. The Blast Radius Score drops from 92/100 to 14/100, the Compromised Nodes counter updates from 3 Tools to '0 Tools (Contained)', the Exfiltrated Scopes indicator transitions to 'none (mitigated)', and the status badge switches to 'CONTAINED (SAFE)'.
When autonomous agents process external data such as support tickets, customer emails, or pull requests, untrusted content can manipulate model instructions. The OWASP GenAI Security Project highlights Prompt Injection (LLM01) and Excessive Agency (LLM08) as primary security vulnerabilities when autonomous systems possess access to high-impact external actions without sufficient privilege separation. OWASP Top 10 for Large Language Model Applications | OWASP Foundation
Without boundary enforcement, an agent compromised at the ingestion tier will execute downstream tool calls in accordance with attacker-supplied instructions, escalating privileges across databases and diagnostic shells. OWASP Top 10 for Large Language Model Applications | OWASP Foundation
The interactive sandbox renders agent execution pipelines as directed graphs using Cytoscape.js, an open-source graph theory and network visualization library. Cytoscape.js
Nodes represent discrete capability components (ingest, database, egress, and shell), while directed edges reflect data passing and invocation paths. During simulation, Cytoscape updates node visual classes to show active compromise or interceptor containment based on the selected defensive policies. Cytoscape.js
Defines core agentic AI vulnerabilities including Prompt Injection and Excessive Agency in autonomous tool-execution pipelines.
Documents the JavaScript graph theory and visualization library used to model and render the agent tool execution DAG.
The blast radius lab is a local topology simulation, not a penetration test. Its first branch assigns score ninety two whenever SQL read only, egress filtering and human approval are all off. Token limiting is not checked in that branch, so enabling the token limit alone still yields ninety two. Bars use four pixels per point. This branch matters more than the later penalty sum. When a core guard is on the penalty branch runs. SQL read only alone leaves thirty for egress, thirty four for missing human approval, and ten for no token limit, giving seventy four. All four guards remove those penalties, but the score is floored at fourteen. Each point occupies five pixels. These are assumed weights, not observed risk rates or enforcement results. The source calls any score at most twenty contained. Its display then says zero tools contained, though the report still stores its computed compromised nodes. A policy manifest contains boolean settings and suggested rules; exporting it does not install guards. Cytoscape visualization requires its external library. Offline paired checks can preserve existing failures but cannot prove healthy remote graphs or actual security efficacy.