Attackers have stolen an API key from AI safety research organization METR and used it for three weeks to consume model credits that would have been worth about $600,000.
METR disclosed the incident in a security update published on Aug 31, alongside highlighting a separate attack in May in which threat actors probed its public infrastructure. It said it had found no evidence that sensitive information was accessed in either incident.
The credits had been supplied free of charge by the unnamed model developer, so the $600,000 represents their commercial value rather than a direct financial loss.
METR said the disclosure concerned external attackers rather than AI agents acting inside its evaluations, where an initial scan had found no evidence of agents hacking third parties.
Read more on AI agent security: NCSC Urges Stronger Controls for Agentic AI Systems
Vibe-Coded App Exposed API Key
The incident began in March when a METR researcher ran agents on a personal Amazon EC2 instance made publicly accessible behind Google authentication. The vibe-coded app held an API key for METR's public models account.
A fail-open flaw silently disabled authentication, leaving the system exposed for several days. METR said it suspected the attacker had found the instance by mining certificate transparency lists for recently registered sites carrying high-signal terms relating to language models and agents.
The attacker prompted an agent to reveal the model provider API key and added an SSH key for persistence, then used the stolen credentials to consume large volumes of model credits over three weeks.
METR said the illicit usage was hard to distinguish from legitimate evaluation activity, since its researchers routinely generated high volumes of model traffic, and it had no way to cap spending on free-credit keys.
The organization revoked the researcher's access, rotated credentials, wiped the laptop and alerted the model developer. It later added spend alerts to keys where possible.
Second Attack Probed Public Infrastructure
METR said it had been tipped off in early May that it was being targeted by attackers who appeared financially motivated and may have been seeking frontier model access.
The attackers made heavy use of agents to automate vulnerability discovery, including credential stuffing, OAuth token grant attempts, scanning of new services and attempts to phish staff.
METR also inadvertently exposed a read-only SQL query mechanism through its public transcript viewer. A bug could have been exploited to reach unpublished evaluation data, and the database had accidentally been loaded with sensitive model data it was not meant to hold.
An independent researcher disclosed the flaw and METR took the interface offline and paid a bounty. It said the attackers had probed the endpoint without appearing to discover or exploit the bug.
METR said it now runs public-facing applications in an environment architecturally separated from its internal infrastructure, and described its wider security measures as accurate to July 30.