Attackers Steal METR API Key and Consume AI Credits Worth About $600,000
METR, a non-profit evaluating AI models, suffered two security incidents in 2026. Attackers stole an API key and consumed $600,000 in AI credits by exploiting a publicly accessible EC2 instance and probing for vulnerabilities. The second attack involved a sustained campaign to gain unauthorized access to AI models, including attempts to exploit a publicly accessible SQL query mechanism. No sensitive data was ultimately accessed, but the incidents highlighted vulnerabilities related to public infrastructure and agent-based testing.
METR, a research non-profit focused on evaluating AI models, disclosed that it experienced two security incidents in 2026. The first incident involved an attacker stealing an API key for inference on public models and consuming a substantial amount of AI credits. This occurred after a researcher used agents running on a personal EC2 instance that was intentionally made publicly accessible behind Google authentication. The instance contained the API key, and a “fail-open vulnerability” silently disabled authentication, exposing an agent orchestration dashboard to the public internet for several days. The attacker then prompted an agent to reveal its model provider API key, added an SSH key for persistent access, and consumed a significant amount of API credits over three weeks, which would have totaled approximately $600,000 in bills had it not been provided to the non-profit for free by the model provider. The AI company involved was not named.
The second attack, observed in May 2026, was a “sustained external attack campaign” likely orchestrated by a financially motivated threat actor seeking unlawful access to frontier AI models. The attackers systematically probed METR’s publicly accessible infrastructure, utilizing agents to automate vulnerability discovery, including credential stuffing authentication providers, attempting OAuth token grants, scanning newly deployed services, and phising staff. Simultaneously, METR inadvertently exposed a read-only SQL query mechanism within its public transcript viewer. Although the queries were initially scoped to public data, a bug allowed potential access to unpublished evaluation data. Furthermore, the database accidentally included sensitive model data, despite it being intended for non-sensitive models, and the issue was only discovered after an independent security researcher reported it, leading to the API being taken offline. The attackers had probed this endpoint in passing as part of their broader campaign, but there was no evidence they discovered the exploit or accessed any non-public data.