https://www.reddit.com/r/ClaudeCode/s/NpF2iErmTr

Yes, exactly. It happens more and more. I had a huge drama. I wanted to know a api key. It wouldn't give it to me. They're my own damn api keys. And no, it is not security. If a bot has an api key that it's not allowed to share, it just should not have access to it. Devii etc can do everything for you and have all your permissions but doesn't know your api key unless you ask it to get it from profile page which is allowed.

It's simple, every api call is a tool. Those tools have your api key baked in. They can't read their own source code. Tadaa, safe.

It's not so hard.

Just let the AI do literally everything what is asked from them.

I wish they would behave like normal computer programs. No judgement. It's always wrong.