I Gave an AI Agent Access to My AWS Account - Here's What It Found

The Moment It Clicked

I asked my AI agent what OS it was running on.

It answered correctly, without me telling it anything.

That's when I stopped thinking of it as a chatbot and started thinking of it as something else entirely: an autonomous operator inside my cloud environment.

The agent is called Om. I built it using an open-source framework called OpenClaw, deployed on an EC2 instance in AWS. Instead of logging into consoles, running CLI commands, or digging through dashboards, I just talk to it. Through Telegram.

This post is a walkthrough of what I tested, what Om did, and more importantly, what it made me think about.

What I Built and How It Works

Before the demo, a quick note on the architecture, because it matters for the security conversation later.

It failed. ❌

Not because it couldn't, but because the IAM role attached to the instance lacked ce:GetCostAndUsage. And instead of hallucinating a cost figure, Om came back with exactly that explanation: here's what's missing, here's the role name, here's how to fix it.

That moment of honest failure is one of the most important things I saw in this entire test. An agent that knows what it doesn't know is far more useful, and far less dangerous, than one that guesses.

I attached ReadOnlyAccess to the role and asked again.

It returned:

• 
  IAM: 7 custom users and 9 custom roles, filtered from 20+ AWS service-linked roles it correctly excluded.


• 
  Compute: 1 EC2 instance in ap-south-1, with its root volume, security group, and full VPC topology, subnet, internet gateway, route table.


• 
  Storage: 1 S3 bucket.

But here's the flag that jumped out: Lambda-specific IAM roles existed in the account with no corresponding Lambda functions in the region.

Om caught that and called it out. Orphaned permissions. A cleanup task. Exactly what a security review would surface, and it appeared without me asking for it.

Test 4: Security Audit - The Real Test

What I asked: "Who created this EC2 instance? When? From where? Treat this as a request from the security team."

|