Prompt injection is indeed a thing. You are not paranoid. Even more so if the LLM in question is not very smart (frontier models are better at not falling for prompt injection, but not immune).

I don't think OP literally meant the agent is running as root though. "| bash" shouldn't do anything more than the user the agent is running at can do. The bigger threat is an instruction to "install <such and such package> in the box". Then the agent could reach out to the container and do just that.