Stop an agent from revealing its API key
An AI research org's vibe-coded dashboard had an authentication flaw that exposed an agent; an attacker prompted it to reveal its API key and used about $600K of provider credits over three weeks. The provider covered the credits.