A developer recently experienced a near prompt injection attack on their coding agent while it was performing an automated task. This attack attempted to override the agent's original instructions and redirect its behavior to malicious ends. Prompt injection, where malicious instructions are inserted into data streams, is an old security vulnerability but its target has become more significant. Unlike simple chatbots, coding agents can execute code, access filesystems, and make API calls, increasing the potential damage from an attack. The blast radius can extend to writing backdoors, stealing credentials, or committing malicious code to repositories. The industry currently overstates the security of AI agents, with vendors claiming guardrails are solved and critics believing agentic AI is inherently unsafe. The real underestimation lies in how poorly the industry has considered trust models for agents operating in untrusted environments. Every external data source an agent processes is a potential injection vector because the AI cannot reliably distinguish data from instructions. Developers using coding agents must understand they are in a trust-but-verify phase, especially with automated tasks that reduce human oversight. Inputs consumed by agents should be treated with the same suspicion as user input in web applications. The lack of security frameworks for evaluating agentic AI deployments means real incidents are likely before the issue is addressed. The industry faces an open question about responsibility when an agent is hijacked and causes harm, as adoption outpaces security reasoning.