They don't need to ask 1Password for the keys, right? They can just take the kubectl auth once 1Password provided the key. But I would also bet any halfway competent script kiddy can vibecode credential stealing for the top 3 password managers these days. Heck, even open source red team stuff like this have it: https://github.com/efchatz/pandora