---
title: "Comment by Andrew on \"The OWASP LLM Top 10 2026 Is Not a Vulnerability List. It's a Blast Radius Document\" | Hashnode"
description: "A code graph tool measured net-negative on a small repo, so I removed it. That unused capability still made it an actor."
url: "https://hashnode.com/posts/owasp-llm-top-10-2026-blast-radius/6a8c0a3a6401eecbc70af341/comment/6a8cf569c029306a7898f107"
---

[Discussion](https://hashnode.com/posts/owasp-llm-top-10-2026-blast-radius/6a8c0a3a6401eecbc70af341)

Comment [The OWASP LLM Top 10 2026 Is Not a Vulnerability List. It's a Blast Radius Document](https://hashnode.com/posts/owasp-llm-top-10-2026-blast-radius/6a8c0a3a6401eecbc70af341)

[Andrew](https://hashnode.com/@rizzdev)

[Aug 25](https://hashnode.com/posts/owasp-llm-top-10-2026-blast-radius/6a8c0a3a6401eecbc70af341/comment/6a8cf569c029306a7898f107)

A code graph tool measured net-negative on a small repo, so I removed it. That unused capability still made it an actor.

[Mohit Kumar](https://hashnode.com/@mkd)

[Aug 26](https://hashnode.com/posts/owasp-llm-top-10-2026-blast-radius/6a8c0a3a6401eecbc70af341/comment/6a8cf569c029306a7898f107#reply-6a8e699aea29377e9d74353e)

That's a really interesting point. I think that's one of the easy-to-miss parts of the actor vs. component distinction, capability itself can expand the blast radius even when the capability isn't being actively used. Removing the unused capability makes sense from a least-privilege perspective. I hadn't thought about measuring it from that angle, but I like the idea.