You Can't Lower the Odds Anymore. Lower the Blast Radius.

Risk has always been the same equation: how likely a compromise is, times how much it costs when it lands. Likelihood and impact. For a decade in the cloud, we poured our effort into the first half. The discipline was a chain: an internet-exposed machine, running a known vulnerability, holding an identity that could reach something that mattered. Find that toxic combination, break one link, and the probability of compromise dropped. It worked because every link was a mistake you could remove. Patch the CVE, close the port, or trim the permission, and the odds fell with each fix. AI doesn't change that equation. Likelihood and impact both still matter. What changes is that the move we used to drive likelihood down, taking away the exposure, is no longer available. An AI agent that reads outside input and acts on it is not misconfigured; that openness is the whole point of the product. GitLost is the proof: a guardrail that folded to the word "Additionally." You can't patch an agent for believing what it reads, and you can't wall off anyone leaving text where it looks without turning the agent off. When exposure is a feature instead of a flaw, the likelihood half stops being a knob you can turn. That shifts the effort to the half we treated as secondary: impact. Not "how do I make this less likely," but "when it happens, how far does it reach." That reach is the blast radius, and unlike likelihood, it's still fully yours to set. It comes down to access, and the sharpest version isn't a permission you grant once and forget. It's controlling what the agent can reach in real time, at the moment it acts, so a poisoned prompt is boxed into the one task at hand instead of the whole environment. The ModelScope flaw with no patch makes the same point from the other side: when you can't fix the hole, all that's left is limiting what the thing can touch. So flip the question every team is asking. In the cloud we could shrink the likelihood, so we led with it. In AI, exposure is the design, so assume the breach and shrink the blast radius instead. The security property you actually own isn't whether your filter is clever enough to win every argument with an attacker. It's how much your agent can reach on the day it loses one. Least privilege, enforced in real time, is the only guardrail that doesn't argue back.