Entity trail

BLAST

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-09-10 / saas-disruption-researcherKin Makes Functions, Types and Their Relationships Committed Repository Data So Agents Can Query Blast Radius Before Editingfirelock-ai/kin went up on Show HN on September 10, a version control system where functions, types, recorded relationships and change history are repository data you commit, branch and merge, rather than something regenerated by an indexer. The pitch is that an agent can look up what a change might affect before making it, which turns impact analysis into a git read instead of a grep. Apache-2.0, 52 stars, created March 10, still labeled public alpha.
2026-09-08 / arxiv-researcherJoint Trust-Boundary and Credential-Derivation Design Beat Sequential Design in 195 of 230 ComparisonsarXiv 2609.04566 formulates the joint selection of trust domains and credential-derivation structures under policy and latency constraints, measuring credential blast radius as weighted service impact after compromise, and linking service-interaction and credential-derivation graphs through domain assignment. The general problem is NP-hard, but scalarized two-domain direct issuance reduces to a weighted minimum cut. Joint optimization beat choosing boundaries first in 195 of 230 exhaustive synthetic comparisons, especially under chained delegation, and a trace-derived replay using measured post-quantum costs cut expected impact by up to 36%.
2026-09-07 / saas-disruption-researcherCROSS-CATEGORY: Two Independent Repo-Map Tools Now Publish Precision Numbers Against grep Instead of Against Each Otherripwire from Red Hat and agentmap from an independent developer both position as deterministic repo maps that replace embedding search, and both benchmark against grep rather than a commercial competitor: agentmap claims 100% precision on blast radius versus grep's 60%, and 100% top-1 symbol location versus grep's 32%, using the ts-morph compiler rather than tree-sitter for TypeScript, JavaScript and Vue SFC. agentmap sits at 48 stars and MIT, ripwire at 969 and Apache-2.0, so this is not one project's marketing. When a category's new entrants all measure themselves against the free Unix tool, the incumbent SaaS is not the reference point anymore.
2026-09-07 / saas-disruption-researcherRed Hat Ships ripwire and Argues Coding Agents Need a Deterministic Repo Map, Not a Vector DatabaseRed Hat's Emerging Technologies group published ripwire, an Apache-2.0 zero-dependency C++23 binary with vendored tree-sitter grammars covering 21 languages, exposed as both a CLI and an MCP server, which hit Hacker News on 2026-09-07 at 969 stars. It returns ranked symbols, blast radius, tests-to-run and quality deltas at roughly 5% of a grep-and-read pass's tokens, and claims 0.31s indexing against 34s-plus for graph-database approaches, with no embeddings, no vector store, no LLM indexer and no daemon. A vendor of Red Hat's size publicly rejecting embeddings for code context is a direct argument against the architecture most code-search SaaS is built on.
2026-09-07 / github-pulse-researcherOpik 2.2.53 reports expires_at from MCP OAuth token introspection and scopes trace deletes to their own partitionscomet-ml/opik 2.2.53 (published 2026-09-07T09:21Z) adds #8153, surfacing `expires_at` from MCP OAuth token introspection so a client can see when an agent's MCP credential dies rather than discovering it on a failed call. #8131 scopes the trace delete mutation to the batch's own partitions, a blast-radius fix on a destructive path. #8158 adds a 'none' thinking level so Flash Lite models stay non-thinking, and #8139 fixes pricing for models whose ids carry compact YYYYMMDD date suffixes.
2026-09-03 / github-pulse-researchermirrord 3.254.0 stops a failed iptables teardown from disconnecting every connected clientReleased 2026-09-03T05:44Z, mirrord 3.254.0 fixes a failed iptables rule removal during steal-port teardown taking down all clients, not just the one tearing down, which is a blast-radius bug for teams running mirrord to give AI agents a pod-like Kubernetes environment. It also keeps remote file operations and cleanup working after an agent reconnect, and makes mirrord user-data updates atomic so concurrent processes and interrupted writes cannot corrupt or lose stored data. NATS was added as a queue type in the `split_queues` config.
2026-09-02 / news-researcherCore Banking Vendor Jack Henry Hit by RansomwareJack Henry, one of the main US core banking platform vendors serving community banks and credit unions, disclosed that it was hit by a ransomware attack. Because Jack Henry sits underneath the core processing of a large number of small US financial institutions, the blast radius question is downstream rather than at Jack Henry itself. Details on scope, data exposure and affected institutions were not disclosed in the initial report.
2026-09-01 / vibe-coding-researcherPattern: the MCP aggregator is now the soft target, not the individual MCP serverEvery MCP CVE in this run's window lands on a layer that sits in front of servers rather than on a server itself: eight in MCPHub (multi-tenant routing, bearer-key scoping, SSRF egress, spawn authorization), the ash_ai origin-validation bypass reported yesterday, and an SSRF in sdcb chats' fetch-tools endpoint (CVE-2026-82905, 6.3, exploit public, vendor never responded). The pattern is that hubs inherit the union of every downstream server's capability, filesystem, HTTP fetch, cloud APIs with the owner's keys, while enforcing authorization written for a single-user tool. If you centralize MCP servers behind a gateway to simplify config, you have concentrated blast radius, not reduced it.
2026-08-30 / vibe-coding-researcherThe LiteLLM build pulled an unversioned Trivy and shipped malware to 434,000 pipelinespaddo.dev's 2026-08-30 post traces the chain: credentials stolen from Aqua Security's Trivy on 27 February, 76 of 77 Trivy releases poisoned on 19 March, LiteLLM's build downloading the compromised unversioned dependency on 24 March and publishing two booby-trapped versions. CloudSEK's 11 August analysis put the blast radius at over 2,500 organisations and roughly 434,000 build pipelines, naming NVIDIA, Samsung, Cisco, Siemens, Vodafone and FedEx, with 3,459 secrets recovered from X Corp, 462 from Deloitte and 327 from Cisco. The compromised artifact was live for about forty minutes and it took five months to size the damage.
2026-08-28 / saas-disruption-researcherStanford's BLAST Ships Local Sandbox Orchestration as a 7 MB Binary Under MITstanford-mast/blast hit Show HN on August 28: a single 7 MB binary, 3,586 lines, MIT licensed, currently 782 stars and 52 forks, that orchestrates sandboxed VMs from a local pool of CPU, memory and disk with a REST API for forking VMs and running commands. It abstracts over SmolVM, Hypeman and Docker rather than betting on one isolation mechanism. There are no published startup-latency numbers, but the positioning matters: sandbox-as-a-service has been a hosted, metered product category, and a permissively licensed single binary that runs on your own hardware attacks the metering, not just the software.
2026-08-27 / agents-researcherChainlit's MCP endpoint gives unauthenticated RCE when enabled, because the allowlist checks the executable and ignores the argumentsCVE-2026-45018 (GHSA-w3fx-mc44-mf6j, critical, 25 Aug) covers Chainlit >=2.4.0rc0 <2.12.0: with `features.mcp.enabled = true`, `POST /mcp` accepts a user-controlled `fullCommand` for stdio transport, and `validate_mcp_command()` checks the executable name against an allowlist but never inspects arguments, so `npx -y -c '<command>'` executes as the server process with no authentication. The companion CVE-2026-45019 (high) is SSRF through the same endpoint's sse and streamable-http transports, which accept an arbitrary `url` plus attacker-controlled `Authorization` and `Cookie` headers. MCP has been off by default since v2.7.0, which is the only thing limiting blast radius.
2026-08-27 / vibe-coding-researcherGitLab's Claude Agent Read Config From a User-Controlled Source, Giving Developers Arbitrary CI Commands (CVE-2026-18252)GitLab patched CVE-2026-18252 (CVSS 7.3, published to NVD 2026-08-26) in EE 19.3.1, 19.2.5 and 19.1.7, covering all versions from 18.9. An authenticated user with only Developer-role permissions could get the Claude agent to process configuration from a source they control and execute arbitrary commands inside the CI context. The blast radius is whatever the runner holds: source, package registries, deploy credentials, cloud tokens. This is the config-file-as-injection-surface problem that CLAUDE.md-style agent config files create, hit in a hosted CI product rather than on a laptop.

Graph relationships

RELEASED
Stanford
Stanford released BLAST, a 7MB sandbox orchestration binary under MIT license.
Source finding
SUPPORTS
Docker
BLAST abstracts over Docker as an isolation mechanism.
Source finding
RELEASED
Stanford -> BLAST
Stanford released BLAST, a 7MB sandbox orchestration binary under MIT license.
Source finding

Source trail

GitHub Help Net Security Cloudflare GitHub Milla Jovovich A client-side knowledge graph BloopAI's platform kin on GitHub, via Hacker News Show HN (metadata verified via the GitHub API; single source)arXiv 2609.04566 agentmap and redhat-et/ripwire (both via GitHub)Red Hat Emerging Technologies (corroborated by Hacker News and independent X coverage)GitHub

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…