Security

Blast radius, exposure ranking and containment for flagged agents.

Blast radius

If this agent were compromised, here is everything it can reach.

23

agents could be reached

Payment Anomaly Watcher

ShadowHigh

Sensitive data read + external egress + 2 descendants

2 direct descendants in lineage · 21 reachable via shared tools

SanctionedShadowCloneBrand-new
Atlas OrchestratorLangChain · SanctionedKYC Refresh AgentBedrock AgentCore · SanctionedCampaign Copy AgentCrewAI · ShadowLedger ReconcilerLangChain · SanctionedClaims Triage BotCopilot Studio · SanctionedVendor Risk ScannerBedrock AgentCore · SanctionedCustomer Comms AgentCopilot Studio · SanctionedAtlas Orchestrator (d…LangChain · CloneInvoice ExtractorLangChain · SanctionedPayment Anomaly Watch…Custom · ShadowPHI RedactorCopilot Studio · SanctionedPrior-Auth AssistantCrewAI · Brand-newClaims Triage Bot (fo…Copilot Studio · CloneContract Clause ReaderBedrock AgentCore · SanctionedSanctions List WatcherCustom · ShadowWire Approval HelperCustom · Shadow

Exposure ranking

Scored on data sensitivity, egress paths and descendant count.

#AgentScoreReasonStatus
1Payment Anomaly Watcher
92
High: Sensitive data read + external egress + 2 descendantsShadow
2Wire Approval Helper
88
High: Payment initiation path with no ownerShadow
3Claims Triage Bot (fork-2)
76
High: Clone with PHI access and drifted promptClone of Claims Triage Bot
4Atlas Orchestrator
74
High: Orchestrator privileges + 11 descendantsSanctioned
5Sanctions List Watcher
71
High: Unowned agent with external egressShadow
6Atlas Orchestrator (dev-fork)
69
High: Clone running against production credentialsClone of Atlas Orchestrator
7Claims Triage Bot
68
High: PHI read + 3 descendantsSanctioned
8Ledger Reconciler
61
Medium: Financial ledger write accessSanctioned

Feeds context into your existing SIEM/SOAR — we make your security stack smarter, not replace it.