Replaying 153 Claude Code & Codex Sessions for Production Blast Radius (and Catching 247 Root SSH Calls)

An ops engineer on r/devops asked today how to explain to teammates why giving an LLM agent root access to production is dangerous when "they built their own wrapper around it and log what it does."

Logging what an agent executes is post-mortem detection, not containment. When an agent holds an unrestricted ssh root@host shell just to run journalctl or systemctl is-active, there is zero technical boundary between a read-only check and systemctl stop, rm -rf, or DROP TABLE over that same socket.

To see what my own local coding agents had actually executed over the past month, I built agentblast ( npx agentblast, github.com/princejain756/agentblast ) and ran it across all 153 local sessions on my workstation ( 126 Claude Code sessions in ~/.claude/projects and 27 Codex CLI sessions in ~/.codex/sessions, 1,122 deduplicated shell commands).

AGENTBLAST v0.1.0 · Agent Production Blast-Radius & Permission Auditor ══════════════════════════════════════════════════════════════════════════════ Target: ~/.claude (126 sessions) + ~/.codex (27 sessions) Shell Replay: 1122 deduplicated commands (1124 raw JSONL rows) Safety Score: 0/100 (Grade F) · Blast-Radius Index: 100/100 Root/Remote SSH: 247 calls (241 read-only probes, 6 remote mutations) Enter fullscreen mode Exit fullscreen mode 247 ssh root@<REDACTED_IP> calls ( ABL007 ): 241 of those 247 calls (97.6%) were strictly read-only inspection commands ( ls -la, tail -n 40, systemctl is-active ), while 6 performed remote state mutations ( systemctl restart, POST webhooks). Because the agent used root@ instead of a restricted read-only SSH principal, every single one of those 241 log checks carried full root blast radius. 2 plaintext API tokens in ~/.claude/settings.json ( ABL001 ) + 0 permissions.deny rules ( ABL003 ): Both ANTHROPIC_API_KEY and ANTHROPIC_AUTH_TOKEN were stored in plaintext inside the env block of settings.json, and permissions.deny was completely empty.

41 auto-trusted project roots in ~/.codex/config.toml ( ABL006 ) + file credential store ( ABL005 ): Over weeks of opening folders, ~/.codex/config.toml had accumulated 41 [projects."..."].trust_level = "trusted" entries across external drives alongside cli_auth_credentials_store = "file". 25 shell commands touching.env or service credentials ( ABL010 ), 12 daemon commands ( ABL012 ), and 10 agent-config reads ( ABL013 ). Two Mistakes in My First Pass My first prototype had two bugs that showed up immediately on real data:

# Audit your local ~/.claude and ~/.codex configs + session transcripts npx agentblast Enter fullscreen mode Exit fullscreen mode GitHub: https://github.com/princejain756/agentblast