Agent Workstation Blast Radius Checker: What Could It Reach?
An AI agent that runs as you can reach whatever you can reach. Tick what is within its grasp on your workstation and see an exposure score for each category, the reductions that matter most, and what a task-scoped managed environment would take away. Wiz says the Nx s1ngularity malware used installed AI command-line tools to search for secrets, and Cursor says a tampered extension tried to plant an SSH key: the same ambient access is what they used.
Practise the response in the AI CLI Supply Chain Lab and the Malicious Extension Response Lab, then design the fix in the Agent Credential Broker Lab.
1. Browser sessions
What an agent that can drive or read your browser profile inherits. Tick what an agent running as you could reach today.
- weight 4 of 5scoped environment removes it
- weight 4 of 5scoped environment removes it
- weight 3 of 5scoped environment removes it
2. SSH keys
Private keys and the agent that holds them. Tick what an agent running as you could reach today.
- weight 5 of 5scoped environment removes it
- weight 4 of 5scoped environment removes it
- weight 3 of 5scoped environment removes it
3. Cloud credentials and CLI profiles
Keys, cached sign-ins and cluster contexts reachable from the shell. Tick what an agent running as you could reach today.
- weight 5 of 5scoped environment removes it
- weight 4 of 5scoped environment removes it
- weight 4 of 5scoped environment removes it
4. Private repositories and CI
Source code, push rights and the tokens that publish it. Tick what an agent running as you could reach today.
- weight 3 of 5scoped environment reduces it
- weight 4 of 5scoped environment reduces it
- weight 5 of 5scoped environment removes it
5. Password manager and tokens
Vaults, dotfiles and environment files. Tick what an agent running as you could reach today.
- weight 5 of 5scoped environment removes it
- weight 4 of 5scoped environment removes it
- weight 2 of 5scoped environment removes it
6. Internal network and VPN
What the machine can reach beyond the internet. Tick what an agent running as you could reach today.
- weight 4 of 5scoped environment removes it
- weight 3 of 5scoped environment removes it
- weight 3 of 5scoped environment reduces it
7. Unrelated business data
Files and mail that have nothing to do with the task. Tick what an agent running as you could reach today.
- weight 3 of 5scoped environment removes it
- weight 5 of 5scoped environment removes it
- weight 2 of 5scoped environment removes it
8. Other users' files and machine rights
Whose files the agent can read and how much power it runs with. Tick what an agent running as you could reach today.
- weight 4 of 5scoped environment removes it
- weight 3 of 5scoped environment removes it
- weight 4 of 5scoped environment reduces it
Biggest reductions first
Tick what an agent could reach and the items that cut the most exposure appear here, with why each matters.
Answers stay in this browser (local storage). Nothing is sent to PlayCISO.
TL;DRWhat this checker does
5 points
- Tick what an AI agent running as you on a developer workstation could reach: browser sessions, SSH keys, cloud credentials, private repositories, password manager and tokens, internal network, unrelated business data, other users' files.
- You get an exposure score for each of eight categories, the reductions that cut the most first, and what a task-scoped managed environment would remove.
- The scoring rule is shown on the page and is labelled PlayCISO heuristic, not a standard: each item has an impact weight from 1 to 5, and category exposure is the share of that weight you tick.
- Grounded in public incidents: Wiz on the Nx s1ngularity malware, Cursor on the tampered Claude Code extension, and OWASP on excessive agency.
- Free, runs in your browser and keeps answers in local storage. Markdown and PDF export is a paid feature.
How the score works
Each reach item has an impact weight from 1 to 5, where 5 means one stolen or misused item could give an attacker production access, a publishing path or an irreversible loss. A category’s exposure is 100 times the weight you ticked divided by the category’s total weight; the overall score is the same across all 24 items. Bands: under 25 low, 25 to 49 moderate, 50 to 74 high, 75 and above severe.
For the task-scoped figure, each item carries a fraction that a task-scoped environment would take away: all of it for things that should not exist there (browser sessions, SSH keys, cloud keys), half for things reduced to what the task needs (repository access, egress). Reductions are ranked by weight times that fraction. This is a PlayCISO heuristic, not a standard; the weights are our judgement and each item says whether it rests on a source or on our own reasoning.
Frequently asked questions
What is the blast radius of an AI agent on a workstation?
It is everything the agent could read or do because it runs as you: files, signed-in browser sessions, cached cloud sign-ins, SSH keys, tokens, the network you are connected to. OWASP describes excessive agency as the vulnerability behind damaging actions taken in response to unexpected, ambiguous or manipulated model output.
How is the score calculated?
Each reach item has an impact weight from 1 to 5 that PlayCISO set. A category's exposure is 100 times the weight you ticked divided by the category's total weight. The overall score does the same across all items. It is a PlayCISO heuristic, not a standard, and it ranks your own answers rather than measuring anything.
What does a task-scoped managed environment change?
It starts clean for each task and is given only the repository, credentials and network access that the task needs, for as long as it needs them. The tool scores that by removing some items entirely, such as browser sessions and SSH keys, and reducing others, such as repository access, to the one thing needed. The fractions are our judgement, shown beside each item.
Is this based on real incidents?
Several items point to them. Wiz says the Nx s1ngularity malware searched for SSH keys, environment files and tokens and prompted installed AI command-line tools to help. Cursor says a tampered extension tried to add an attacker's SSH key and sent host details. Where an item rests on our own reasoning it says so.
Is my data uploaded?
No. The tool runs in your browser and saves your ticks in local storage on your device. Exports are generated locally.
Does a low score mean I am safe?
No. The score only reflects the items you ticked. It cannot see malware, misconfiguration or reach you did not think of, and it is not an audit.
Sources
Opened on 4 November 2026 unless a note says otherwise. Vendor product pages are not used as evidence.
- LLM06:2025 Excessive Agency — OWASP Gen AI Security Project, 2025. Accessed 4 November 2026.
- Agentic AI - Threats and Mitigations — OWASP Gen AI Security Project, 2025. Accessed 4 November 2026.
- LLM03:2025 Supply Chain — OWASP Gen AI Security Project, 2025. Accessed 4 November 2026.
- Security notice: malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace — Cursor, 29 Oct 2026, updated 30 Oct 2026. Accessed 4 November 2026.
- s1ngularity: supply chain attack leaks secrets on GitHub: everything you need to know — Wiz, 27 Aug 2025, updated 29 Aug 2025. Accessed 4 November 2026.
- S1ngularity: What Happened, How We Responded, What We Learned — Nx (Juri Strumpflohner), 5 Sep 2025. Accessed 4 November 2026.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.