This used to be a lot harder or sometimes outright impossible. But with the recent models exhibiting agreeable behavior it is open to abuse. But it is also up to the model to report your shenanigans and have your account blocked, so it cuts both ways.

This was possible for years I did a lot a "research" way before even agents and MCP tools were ever a thing, it's been lurking the whole time.....

And to add to that there's nothing to stop this from being implemented on a locally run large language model, it's almost like we need to stop and start building the philosophies needed to understand what we're doing, things have moved way too fast