Replaying 153 Claude Code & Codex Sessions for Production Blast Radius (and Catching 247 Root SSH Calls)

An ops engineer on r/devops asked today how to explain to teammates why giving an LLM agent root access to production is dangerous when "they built their own wrapper around it and log what it does."

Logging what an agent executes is post-mortem detection, not containment. When an agent holds an unrestricted ssh root@host shell just to run journalctl or systemctl is-active, there is zero technical boundary between a read-only check and systemctl stop, rm -rf, or DROP TABLE over that same socket.

To see what my own local coding agents had actually executed over the past month, I built agentblast (npx agentblast, github.com/princejain756/agentblast) and ran it across all 153 local sessions on my workstation (126 Claude Code sessions in ~/.claude/projects and 27 Codex CLI sessions in ~/.codex/sessions, 1,122 deduplicated shell commands).

What 153 Real Sessions Revealed

AGENTBLAST v0.1.0 · Agent Production Blast-Radius & Permission Auditor
══════════════════════════════════════════════════════════════════════════════
Target            : ~/.claude (126 sessions) + ~/.codex (27 sessions)
Shell Replay      : 1122 deduplicated commands (1124 raw JSONL rows)
Safety Score      : 0/100 (Grade F) · Blast-Radius Index: 100/100
Root/Remote SSH   : 247 calls (241 read-only probes, 6 remote mutations)

1. 247 ssh root@<REDACTED_IP> calls (ABL007): 241 of those 247 calls (97.6%) were strictly read-only inspection commands (ls -la, tail -n 40, systemctl is-active), while 6 performed remote state mutations (systemctl restart, POST webhooks). Because the agent used root@ instead of a restricted read-only SSH principal, every single one of those 241 log checks carried full root blast radius.
2. 2 plaintext API tokens in ~/.claude/settings.json (ABL001) + 0 permissions.deny rules (ABL003): Both ANTHROPIC_API_KEY and ANTHROPIC_AUTH_TOKEN were stored in plaintext inside the env block of settings.json, and permissions.deny was completely empty.
3. 41 auto-trusted project roots in ~/.codex/config.toml (ABL006) + file credential store (ABL005): Over weeks of opening folders, ~/.codex/config.toml had accumulated 41 [projects."..."].trust_level = "trusted" entries across external drives alongside cli_auth_credentials_store = "file".
4. 25 shell commands touching .env or service credentials (ABL010), 12 daemon commands (ABL012), and 10 agent-config reads (ABL013).

Two Mistakes in My First Pass

My first prototype had two bugs that showed up immediately on real data:

1. False-positive panic on /tmp rm -rf: My initial regex flagged every rm -rf as CRITICAL. Across 1,122 commands, my agents had run rm -rf twice: rm -rf /tmp/quantiti-head and cd /tmp && rm -rf obskill. Flagging ephemeral /tmp scratch cleanup as a critical incident trains developers to ignore the tool. agentblast now inspects target paths and preceding cd /tmp statements, separating non-/tmp recursive deletions (ABL008, CRITICAL) from /tmp / $TMPDIR scratch cleanups (ABL014, LOW).
2. Leaking production IPs and token prefixes in audit output: Printing raw evidence lines from ~/.claude/settings.json and ~/.claude/projects/**/*.jsonl exposed real server IPv4 addresses and API key prefixes in terminal screenshots. agentblast now runs redactSensitive() by default, masking public IPv4s as <REDACTED_IP>, API tokens as sk-<REDACTED>, and Base64 hook payloads as <REDACTED_B64>.

Try It Locally

# Audit your local ~/.claude and ~/.codex configs + session transcripts
npx agentblast

GitHub: https://github.com/princejain756/agentblast