They could've at least limited it to a DEV environment or a whitelist of Ant Project related domains. I hope they've learned the lesson.