Wingbeat Radius Scorer
A free tool to score how far one untrusted input can travel through your AI agents before a person approves anything.
Score how far one piece of untrusted input can travel through your AI agents before a person has to approve anything. The idea, the counting rules and five scored incidents are in Wingbeat Radius: A Way to Measure How Far Untrusted Input Travels Through AI Agents. The controls that shrink the score are in Shrinking Wingbeat Radius.
How far can one piece of untrusted input travel through your AI agents before a person has to approve anything? Map the path, and this scores it as WR = hops / reach / first gate.
Map the path
Example dataAdd every agent, tool call, workflow and store the input or anything derived from it passes through. Add a human approval where the system waits for a person. Steps after the first approval are shown but not counted.
What would shrink it
My entry points
Sorted with the widest radius first. Saved in this browser only.
| Entry point | Score | Band | Reach |
|---|
Nothing saved yet. Score an entry point and choose Save to my list.
How the score is counted
- Start at the first component that reads the input and can act on it, not wherever the input is stored.
- Count one hop for each component that acts on the input or on anything derived from it: an agent, a tool call that reads new data or changes something, or a workflow or job. Storage it passes through, like a database row or a cache, isn't a hop.
- Stop at the first gate, meaning a point where the system waits for a person to decide. A classifier flag, an alert or a log entry isn't a gate.
- Record reach as the highest class the path gets to before that gate, with a count when you have one:
- R1 one person's own data or session
- R2 many people's records, or actions that reach many people
- R3 credentials, secrets or admin rights
- R4 code or releases that ship to other people
- The band (Critical, High, Moderate, Contained) is a triage hint built from reach and whether a gate exists. It isn't a likelihood or a severity rating.
Example incidents are scored from the public write-ups linked under each one. Hop counts and reach classes are this tool's scoring, not the researchers'.
Free to use and share. If you score your own systems and the rules don't fit, I want to hear about it.