Well you also provide an assistant object, so one might just use a different assistant. But maybe I'm wrong. Will dig into it next week and try to use an API key which is not mine in order to see if I'm safe 🙂