Attacker stole METR API key, used $600K of credits, no one noticed for weeks | Dark Hacker News