Attackers Steal METR API Key and Consume AI Credits Worth About $600,000
METR, a frontier AI evaluation non-profit, suffered two security incidents in 2026 involving stolen API keys and unauthorized access attempts Attackers exploited a "fail-open vulnerability" in a vibe-coded app to steal an API key and consumed approximately $600,000 worth of AI credits over three weeks A second attack campaign involved systematic probing of public infrastructure using automated agents for credential stuffing, OAuth token grants, and staff phishing No sensitive evaluation data was
Analysis
TL;DR
- METR, a frontier AI evaluation non-profit, suffered two security incidents in 2026 involving stolen API keys and unauthorized access attempts
- Attackers exploited a "fail-open vulnerability" in a vibe-coded app to steal an API key and consumed approximately $600,000 worth of AI credits over three weeks
- A second attack campaign involved systematic probing of public infrastructure using automated agents for credential stuffing, OAuth token grants, and staff phishing
- No sensitive evaluation data was compromised, but an inadvertently exposed SQL endpoint contained sensitive model data that was later discovered by an independent security researcher
Why It Matters
This incident highlights the growing threat of AI credit theft and the security risks associated with rapidly deployed, minimally secured applications in the AI research ecosystem. It demonstrates how threat actors are increasingly leveraging AI agents themselves to automate vulnerability discovery and credential harvesting at scale.
Technical Details
- The March 2026 incident involved a researcher's personal EC2 instance running an agent orchestration dashboard behind Google authentication that suffered a fail-open vulnerability, silently disabling authentication and exposing the system to the public internet
- Attackers discovered the exposed instance by scanning certificate transparency lists for recently registered websites containing LLM/agent-related keywords, then prompted the agent to reveal its API key and added an SSH key for persistent access
- The May 2026 campaign featured sustained external probing using automated agents for credential stuffing, OAuth token grant attempts, service scanning, and staff phishing attempts
- An inadvertently exposed read-only SQL query mechanism in METR's public transcript viewer contained sensitive model data due to a scoping bug, though no unauthorized access was detected
- The $600,000 in credits went unpaid because the model provider supplied them free of charge to the non-profit, and the abuse went undetected due to lack of token spend caps and high baseline usage from legitimate evaluations
Industry Insight
- Organizations deploying AI agents should implement strict spend caps and real-time monitoring alerts on API keys, as abuse can go undetected in high-traffic evaluation environments
- The "vibe-coding" trend of rapidly building applications with minimal security oversight creates significant attack surfaces that threat actors are actively scanning for using automated reconnaissance
- AI-powered attack automation is becoming sophisticated enough to systematically probe multiple attack vectors including credential stuffing, OAuth exploitation, and social engineering, requiring defense-in-depth strategies
Disclaimer: The above content is generated by AI and is for reference only.