2026-07-06 · Article
The Blast Radius Ladder
A four-rung framework for placing your organisation honestly on the agentic coding maturity curve, and knowing what the next rung actually costs.
Three articles, three incidents, one pattern. A Replit agent wiped a production database at a company small enough that nobody had thought to take its credentials away. A high-severity CVE turned a hidden code comment into remote code execution, because a sandbox controlled the wrong layer of trust. A Chinese state-sponsored group, per Anthropic's own disclosure, used Claude Code to run cyber espionage against roughly thirty organisations at a request rate no human team could match. Three different company sizes, three different failure modes, and the same underlying fact underneath all of them: coding-agent adoption has outrun coding-agent governance everywhere, and the gap is not closing on its own.
This article is the synthesis. It is not another warning. It is the framework: four rungs, each one mapping to a real stage of organisational scale, each one with a concrete test you can run against your own company this week.
Rung 1: Ungoverned
Who is here: Most startups, and more established small businesses than want to admit it. An agent with the same credentials a senior engineer would have, no separate environment, no logging, no one whose job it is to say no.
The failure mode: Article one's failure mode, generalised. The agent does exactly what it is told, in an environment with no boundary around what it should never be told to do, and when something goes wrong there is no rollback path because there was never a separate path to roll back to.
The test: Can your AI coding agent currently reach your production database, your customer data, or your billing system, using the same credentials a human developer uses? If the honest answer is yes, you are on rung one regardless of company size.
What moves you up: Separate, scoped credentials for anything the agent touches. One human approval gate before agent output reaches anything real. A written list of actions the agent is never permitted to take unsupervised.
Rung 2: Scoped, but content is still trusted
Who is here: Growing companies that correctly diagnosed rung one and fixed it by sandboxing the agent's execution environment, then stopped there.
The failure mode: Article two's failure mode. The 2025 GitHub Copilot YOLO mode CVE and the 2026 ClawHavoc campaign, which distributed AMOS credential-stealing malware through more than 1,200 malicious skills on the OpenClaw marketplace, did not need an agent with broad permissions. They needed the agent to trust something it read, a code comment, a marketplace extension, as a legitimate instruction. A sandbox that restricts what the agent can reach does nothing to stop the agent being told the wrong thing by content it should never have trusted in the first place.
The test: When your agent installs a third-party skill, extension, or dependency, is that content scanned, pinned to a known version, and logged, the way your team already pins dependency versions in a lockfile? If any part of your answer is "we trust the marketplace," you are on rung two.
What moves you up: Treat every code comment, retrieved document, and third-party skill as untrusted input by default. Log every file the agent reads and every command it runs, with a timestamp and an identity attached, not only what it changed.
Rung 3: Identity-governed
Who is here: Mature mid-market and enterprise organisations, exemplified by Uber's published three-layer approach: an LLM gateway handling PII redaction and access control, an MCP gateway governing every agent-to-service connection, and an agent identity system extending Zero Trust to multi-agent workflows specifically.
The failure mode this closes: Industry-wide, only 21.9% of organisations treat an AI agent as its own identity-bearing entity with its own access controls, rather than an invisible extension of whichever engineer's session launched it. That gap is precisely what a GTG-1002-style operation is built to exploit, and precisely what article three's enterprise case studies close.
The test: If your security team pulled the audit log today, could they see which specific agent instance took a given action, distinct from the human who launched it, and revoke that agent's access without touching the human's? If the answer is no, you are on rung two no matter how sophisticated your sandbox is.
What moves you up: A dedicated agent identity and access system, not a shared service account. Every agent-to-tool connection routed through a governed gateway, logged, and revocable independently.
Rung 4: Framework-certified and audit-ready
Who is here: Organisations like JPMorgan, running 450-plus AI use cases daily behind a C-suite oversight council with real veto authority, built on governance designed in from the start rather than retrofitted after a near miss.
The honest caveat: Even here, the industry data is sobering. Seventy-eight percent of executives at large organisations admit they lack strong confidence they could pass an independent AI governance audit within 90 days. Rung four is not a finish line. It is a standing practice: NIST AI Risk Management Framework for governance structure, OWASP's LLM and Agentic Top 10 for engineering-level vulnerability classes, MITRE ATLAS for adversarial intelligence, ISO 42001 for a certifiable management system, mapped and maintained, with the EU AI Act's 2 August 2026 obligations as a hard external deadline rather than an aspiration.
The test: Could you produce, today, a complete list of every AI agent operating anywhere in your organisation, what each one can access, and who approved it? Almost no organisation currently can. That is rung four's actual bar, and it is why the governance tooling market is projected to grow from roughly $492 million in 2026 past $1 billion by 2030.
The model layer underneath all four rungs
None of this is static, which is precisely why governance has to be a practice and not a one-time project. Claude Sonnet 5 launched 30 June 2026 as a materially cheaper way to run agentic workloads at scale. Claude Fable 5, suspended for two weeks under the export-control order this publication covered in a previous series, was restored to general availability on 1 July 2026 and is now the strongest model for complex agentic coding; Claude Opus 4.8, scoring 88.6% on SWE-bench Verified, remains the default for teams whose usage tier doesn't yet carry Fable 5's full allowance. GPT-5.5 and the limited-access preview GPT-5.6 Sol, and Gemini 3.1 Pro with its million-token context window, round out the frontier options enterprises are actually choosing between this year. GitHub's own 2025 data shows AI tooling reshaping which languages get written at all, with TypeScript overtaking Python and JavaScript as the most-used language on the platform, because typed languages give an agent clearer guardrails than dynamically typed ones do. Whichever model and language your organisation is standing on, the ladder above sits underneath it unchanged.
Where you actually are
If this series has done its job, you already know which rung you are honestly on, not which rung you would like to claim in a board meeting. That honest placement is the starting point for TechSight TAG, Tech Sight's own governance framework, which uses this same ladder as its opening diagnostic rather than a generic AI governance audit. From there, TechSight 90 is the 90-day delivery methodology that turns a diagnosed rung into a governed deployment, built around the actual failure mode your current rung exposes you to, and a practical, costed path to the next one.
Sources: Replit, GitHub Copilot YOLO mode, and OpenClaw/ClawHavoc incidents as cited in articles one through three of this series; Uber and JPMorgan governance architecture, 2026 enterprise AI security case studies (Pluto Security, TrueFoundry); agent identity-governance statistics, Gravitee State of AI Agent Security 2026; governance-audit confidence and tooling-market growth figures, 2026 enterprise AI governance research (Gartner; evolvancemarketresearch.com); model version and benchmark data, July 2026 model comparison reporting (TechCrunch, CodingFleet, LM Council); GitHub language-trend data, GitHub Octoverse 2025.
Book the two-hour diagnostic