Attackers Consumed $600K in AI Credits Via Stolen METR Key

Someone stole an API key from METR, an AI safety research nonprofit that evaluates frontier models, and quietly ran up about $600,000 in model credits over three weeks before anyone noticed, The Hacker News reported.

The origin was mundane. A METR researcher had spun up an agent orchestration dashboard on a personal EC2 instance, meant to sit behind Google authentication. The 'vibe-coded app' had a fail-open authentication bug that briefly exposed it to the open internet. Attackers appear to have found the instance by scanning certificate transparency lists for recently registered domains carrying LLM and agent-related keywords, then prompted the running agent directly to reveal the model-provider API key. They added an SSH key for persistence and started spending.

No billing alert fired because the credits had been donated free of charge by the unnamed model provider. Detection also stumbled on the noise of ordinary evaluation work. 'We regularly run evaluations that use a lot of tokens,' METR wrote, and staff were 'very acclimated to getting lots of weird rate limit and API errors,' per The Register's account.

METR also disclosed a second incident from May, when a 'likely financially motivated' actor systematically probed its public infrastructure with automated agents: credential stuffing, OAuth token attempts, service scanning, phishing. A separate bug in a public transcript viewer left a read-only SQL query mechanism that could have exposed unpublished evaluation data. An independent security researcher reported it before attackers found it.

Three researchers we track flagged the disclosure the same week. METR says it has hired a security lead and plans to expand the security team.