Credential Blast Radius

Credential blast radius is the maximum damage an attacker can cause if one API key, token, SSH key, or similar credential is stolen. The important question is not only whether the credential was secret, but what it can reach: which systems, which data, which actions, how long it remains valid, and whether it enables lateral movement. In AI-agent environments the radius can expand quickly because agents may use credentials to call tools, edit repositories, start cloud resources, or trigger external workflows. A long-lived CI key with broad permissions carries a very different risk profile from a short-lived token with a narrow scope. The practical test is simple: if this credential leaked today, how far could someone get without exploiting any other vulnerability? Good architecture reduces the blast radius through least privilege, short expiry, separate identities per agent or workflow, network boundaries, approval gates, and fast revocation paths. The term turns credential security into something concrete and testable instead of a vague instruction to protect secrets.