Attacker stole METR API key, used $600K of credits, no one noticed for weeks | Hacker News Reader