There's a line going around dev.to this week that stuck with me: your AI agent's chat history is user input. It's a security observation about chatbots. But if you've given an agent cloud credentials — and half the "I let an agent run my ops" posts on here have — that line stops being about chatbots and becomes the scariest sentence in your architecture.
Here's the uncomfortable version: when an agent can call cloud APIs, prompt injection is remote code execution on your infrastructure. Let me walk through exactly how, because the attack surface is bigger and dumber than most people realize.
The classic framing, and why it undersells the risk
Prompt injection in a chatbot: attacker gets the bot to say something it shouldn't, or leak its system prompt. Bad, embarrassing, usually contained.
Prompt injection in an ops agent: attacker gets the agent to TerminateInstances, exfiltrate secrets to an external endpoint, or open a security group to 0.0.0.0/0. The agent has an IAM role. The IAM role has real permissions. Every check is green — because the agent is allowed to do those things; that's its job. (I wrote a whole separate piece on why IAM being green is exactly the trap.)
