While debugging in Cursor a couple weeks ago, Opus 4.6 chirped it had discovered that my token, when base64 decoded, had a date that was in the past - perhaps expired?

And it was expired!

And I was happy. And some time passed - and I realized it had read my .env file and performed operations on my API keys.

That these models do all this stuff already makes me assume any skill take over is simply trivial.