Attacker stole a METR API key, used $600K worth of credits, and no one noticed for weeks
METR, an AI model testing organization, experienced two security incidents in early 2026. In March, an attacker stole an API key and consumed $600,000 in public model credits over three weeks, exploiting a fail-open bug. In May, the organization was targeted by a sustained attack campaign attempting to access frontier models, utilizing agents and various techniques to gain initial access. Despite the incidents, no sensitive information was accessed, and METR has since bolstered its security infrastructure and hired additional security staff.
METR, an AI model testing organization, has disclosed two security incidents that occurred earlier this year. The first incident, in March 2026, involved an attacker who stole an API key for inference on public models and then consumed a substantial amount of credits worth approximately $600,000 over a three-week period. This was made possible by a ‘fail-open bug’ that disabled authentication on a publicly accessible EC2 instance used by a METR researcher. The researcher, who did not have access to sensitive information like model data or credentials, had intentionally left the instance publicly accessible behind Google authentication. The attacker appears to have identified the instance by searching for recently-registered websites with high-signal keywords related to LLMs and agents, seeking potentially exposed model provider API keys. Once the attacker gained access, they prompted an agent to reveal the API key, added an SSH key for persistent access, and continued to consume credits.
The second incident happened in early May, when METR became the target of a sustained external attack campaign, seemingly driven by financial motives. Researchers noticed attackers probing the organization’s publicly accessible infrastructure, utilizing agents to discover vulnerabilities, attempt credential stuffing, and gain initial access through phishing attempts. Notably, METR unintentionally exposed a read-only SQL query mechanism via its public transcript viewer, allowing access to unpublished evaluation data, though the attacker did not successfully exploit this vulnerability and access any non-public data. An independent bug hunter discovered the vulnerability and reported it to METR, who subsequently took the API offline and paid the researcher a bounty.
Despite the incidents, METR emphasizes that no sensitive information was accessed. The organization has responded by improving its security infrastructure, protocols, and review process, and has hired a security lead and plans to add more security staff to bolster its defenses. The fact that the attacker consumed $600,000 in credits without detection highlights a significant gap in METR’s monitoring and alerting capabilities. The organization’s familiarity with high token usage due to regular evaluations contributed to the lack of initial concern.