Railway got hit by pretty much this a few days ago. Attacker likely used abliterated models, stolen keys, ~$740k in AI charges. If it happens to them, random Lovable apps are easy targets.