This is a good reminder that "AI startup" and "security-first" don't automatically go together. A $10B valuation doesn't buy you a mature security posture. Curious what the actual attack surface was — the article mentions scraped data but not the vector.