I built a vulnerable app and spent $1,500 seeing if LLMs could hack it