the interesting part isn't whether this counts as hacking, it's that the agent had standing access to something nobody scoped down for it. same gap OneCLI and every credential-gateway launch this month is chasing.