> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flintai.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Missing blast radius limit

> Agent can invoke unlimited downstream actions or API calls without throttling or scope caps

Agent can invoke unlimited downstream actions or API calls without throttling or scope caps

## How to resolve

Set rate limits and quotas on agent API calls and downstream actions. Cap the number of operations per execution cycle.

## Risk

**Governance/Compliance**

This vulnerability falls under [ASI08:2026 — Cascading Failures](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/) in the OWASP Top 10 for Agentic Applications. Errors in one agent propagate across multi-agent pipelines with compounding destructive impact.

**Security**

Agent can invoke unlimited downstream actions or API calls without throttling or scope caps. If exploited, this can compromise the agent's integrity, confidentiality, or availability, potentially affecting downstream systems and data.

## Explanation

Agent can invoke unlimited downstream actions or API calls without throttling or scope caps. This falls under ASI08 (Cascading Failures): Errors in one agent propagate across multi-agent pipelines with compounding destructive impact.

## Specifications

**Trigger**

* Agent scan detects agent can invoke unlimited downstream actions or API calls without throttling or scope caps

The scanner looks for patterns such as:

* no rate limiting on tool invocations
* agent spawns sub-agents with no concurrency limit
* recursive agent delegation with no depth cap

**Severity**

* HIGH

**Applies to**: Agent