Framework · AI Security
The Likelihood Collapse
Why AI risk management moves from probability to blast radius
The Likelihood Collapse describes a structural break in how security risk can be managed. Risk has always been likelihood multiplied by impact. For a decade of cloud security, defenders invested almost entirely in the likelihood term, because every contributing factor — an exposed machine, an unpatched vulnerability, an over-permissioned identity — was a removable mistake. AI agents end that. An agent that reads untrusted input and acts on it is not misconfigured; that openness is the entire product. You cannot patch an agent for believing what it reads. When exposure is the design rather than the defect, likelihood stops being a knob defenders can turn, and the only remaining variable they still fully own is impact — the blast radius.
The equation defenders inherited
Risk has always been the same equation: how likely a compromise is, multiplied by how much it costs when it lands. Likelihood and impact.
For a decade in the cloud, we poured our effort into the first half. The discipline was a chain: an internet-exposed machine, running a known vulnerability, holding an identity that could reach something that mattered. Find that toxic combination, break one link, and the probability of compromise dropped. It worked because every link was a mistake you could remove. Patch the CVE, close the port, or trim the permission, and the odds fell with each fix.
What AI changes — and what it doesn't
AI does not change the equation. Likelihood and impact both still matter. What changes is that the move we used to drive likelihood down — taking away the exposure — is no longer available.
An AI agent that reads outside input and acts on it is not misconfigured. That openness is the whole point of the product. You cannot patch an agent for believing what it reads, and you cannot wall off everyone who might leave text where the agent will look without turning the agent off.
This is the collapse: when exposure is a feature instead of a flaw, the likelihood half stops being a knob you can turn. It does not fall to zero. It falls out of your control.
Where the effort has to go instead
That shifts the effort to the half the industry treated as secondary: impact. Not "how do I make this less likely," but "when it happens, how far does it reach."
That reach is the blast radius, and unlike likelihood, it is still fully yours to set. It comes down to access — and the sharpest version is not a permission you grant once and forget. It is controlling what the agent can reach in real time, at the moment it acts, so a poisoned prompt is boxed into the one task at hand instead of the whole environment.
Least privilege, enforced at runtime, is the only guardrail that doesn't argue back.
How to apply it
Stop scoring AI systems on how well their input filters hold. Filters are an argument you eventually lose; the security property you actually own is what the agent can reach on the day it loses one.
Assume the breach at the input boundary and measure the agent instead on reachability: what identities it holds, what tools and data it can touch, and whether that set is scoped per task at the moment of action or granted broadly in advance.
Treat runtime authorization — not prompt hardening — as the primary control. Posture used to be a photograph, a point-in-time scan that told you how things stood. Agent risk is created at runtime, so the question is no longer "is this configured correctly?" It is "given who's asking, and with what authority, should this happen right now?"
The Likelihood Collapse was introduced by Asaf Nakash, Principal Product Manager for AI Security at Microsoft Defender and host of the Context Window podcast, in Context Window Edition #23 (July 13, 2026).