Attackers steal METR API key, consume $600,000 in AI credits
Attackers stole an API key from a publicly exposed METR research system in March 2026 and used it to consume $600,000 in AI model credits over three weeks. METR discovered the compromise after the attacker had established persistence on the system and disclosed two separate security incidents on 31 August 2026.
What happened
In March 2026, attackers stole an API key from a METR researcher's personal Amazon EC2 instance that was made publicly accessible behind Google authentication. The instance ran a vibe-coded app containing the API key for METR's public models account; a fail-open flaw in authentication disabled protection for several days.
The attacker prompted an agent to reveal the model provider API key and added an SSH key for persistence. Using the stolen credentials, the attacker consumed $600,000 worth of model credits over three weeks. METR suspected the attacker found the instance by mining certificate transparency lists for recently registered sites with high-signal terms relating to language models and agents.
Reported impact
The credits had been supplied free of charge by the unnamed model developer, so the $600,000 represents their commercial value rather than a direct financial loss to METR. The illicit usage was hard to distinguish from legitimate evaluation activity, since METR researchers routinely generated high volumes of model traffic.
Index analysis
METR had no way to cap spending on free-credit keys, allowing the attacker to consume large volumes of credits without detection. The organization found no evidence that sensitive information was accessed in the incident.
Governance controls
In response, METR revoked the researcher's access, rotated credentials, wiped the laptop and alerted the model developer. The organization later added spend alerts to keys where possible and hired a security lead, shutting down legacy infrastructure that expanded its attack surface.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.