Hacker News Daily: The Hottest Threads and Top Tech Stories

Stolen artificial intelligence API keys racked up nearly one million dollars in unauthorised charges for a single enterprise, according to findings published this morning by Google Threat Intelligence. In episode two twenty-two, we tracked the security drama brewing across developer infrastructure; now, the literal bill has arrived. Here is the sweep across the wires this hour. A developer named JaTochNietDan launched Rustable, an open-source database client written in Rust that compiles directly to WebAssembly to run inside a browser tab without commercial paywalls. Meanwhile, a community reader called Hacker Times picked up two hundred sixty points by reformatting the front page into an hourly broadsheet. Over in production infrastructure, OpenAI published technical details on Pando, an internal backend serving nearly a petabyte of Git data daily to handle concurrent agent workloads.

At the same time, Linux administrators marked three weeks without an official Ubuntu kernel patch for a critical remote code execution vulnerability, CVE-2026-98432. And an analysis in Tech Policy Press called on regulators to block Anthropic's planned public offering, pointing to nearly nine hundred billion dollars in long-term compute commitments. Now look closely at that million-dollar cloud breach, because we have seen this structural failure before. In the nineteen-nineties, corporate telecom private branch exchanges were routinely compromised for long-distance toll fraud. Attackers didn't steal the hardware; they hijacked dialling privileges and routed calls through premium numbers until finance noticed the invoice at month-end. That pattern is repeating word for word with frontier models. The compromise itself is plain credential theft.

But where the analogy breaks down is velocity. An automated script calling an expensive inference endpoint burns through thousands of dollars an hour without touching a single local hard drive. The credential isn't just access to data anymore; it's an open line of credit directly into someone else's data centre. That part is confirmed by the threat data; what enterprises are still trying to settle is how to cap real-time consumption before billing alarms trip. So what does it all add up to? When software shifts from static licenses to meter-drained compute, your security perimeter is no longer your firewall—it's your spending limit. Next quarter turns on automated billing circuit breakers, not perimeter patches. That is the picture from here. Back to you in the studio.