AI Token Jacking Lets Hackers Steal API Keys and Rack Up Nearly $1 Million in Charges