{"schema_version":"0.10.0","id":"LR-2026-0732","record_version":1,"title":"Attackers steal METR API key and burn $600,000 in AI credits","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":52.9,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":4.16,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: Infosecurity Magazine · subject to change","original_document":null,"reports_total":2,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: Infosecurity Magazine · subject to change"}]},"sources_hash":"10ae617e7d5109f14d1f330c4329acb82a79870dbc4c1c0b52cd21eb3e650fd5"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-09-01","incident_class":"security_compromise","failure_class":"credential_misuse","agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":"P21D","detection_method":"victim","summary":"An API key for METR's public models account, held in a researcher's vibe-coded app on a personal cloud instance, was stolen and used for about three weeks to consume model credits that the sources value at about $600,000. The instance had been made publicly accessible behind Google authentication, and a fail-open flaw silently disabled that authentication, leaving it exposed for several days. The attacker prompted an agent to reveal the provider API key and added an SSH key for persistence. METR said the illicit usage was hard to distinguish from legitimate evaluation activity, and that it had no way to cap spending on free-credit keys. The sources do not say how the misuse was first detected. METR revoked the researcher's access, rotated credentials, wiped the laptop, alerted the model developer and later added spend alerts. METR said it had found no evidence that sensitive information was accessed in either incident.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK03"},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Moderate test: a third party's systems were touched (the model developer's credits were consumed), with a bounded scope stated as three weeks; the $600,000 is commercial value, not direct loss.","harm_class":["financial"],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.infosecurity-magazine.com/news/attackers-steal-metr-api-key/","publisher":"Infosecurity Magazine","date":"2026-09-01","type":"press","title":"Attackers Steal METR API Key and Burn $600,000 in AI Credits - Infosecurity Magazine","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://www.thestack.technology/how-a-vibe-coded-app-let-hackers-use-600k-worth-of-ai-tokens-at-metr/","publisher":"www.thestack.technology","date":"2026-09-01","type":"press","title":"How a vibe-coded app let hackers use $600k worth of AI tokens at METR - www.thestack.technology","archived_url":null}],"per_field_confidence":{"event.incident_class":"C","event.agent_involved":"C","event.failure_class":"C","event.adversarial_actor":"C","event.detection_method":"C","event.duration":"C","impact.harm_class":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"Attackers have stolen an API key from AI safety research organization METR and used it for three weeks to consume model credits that would have been worth about $600,000."}],"event.agent_involved":[{"source_index":0,"quote":"The attacker prompted an agent to reveal the model provider API key and added an SSH key for persistence, then used the stolen credentials to consume large volumes of model credits over three weeks."}],"event.failure_class":[{"source_index":0,"quote":"The attacker prompted an agent to reveal the model provider API key and added an SSH key for persistence, then used the stolen credentials to consume large volumes of model credits over three weeks."}],"event.adversarial_actor":[{"source_index":0,"quote":"METR said the disclosure concerned external attackers rather than AI agents acting inside its evaluations, where an initial scan had found no evidence of agents hacking third parties."}],"event.detection_method":[{"source_index":0,"quote":"METR disclosed the incident in a security update published on Aug 31, alongside highlighting a separate attack in May in which threat actors probed its public infrastructure."}],"event.duration":[{"source_index":0,"quote":"Attackers have stolen an API key from AI safety research organization METR and used it for three weeks to consume model credits that would have been worth about $600,000."}],"impact.harm_class":[{"source_index":0,"quote":"The credits had been supplied free of charge by the unnamed model developer, so the $600,000 represents their commercial value rather than a direct financial loss."}],"impact.severity":[{"source_index":0,"quote":"The credits had been supplied free of charge by the unnamed model developer, so the $600,000 represents their commercial value rather than a direct financial loss."}],"impact.severity_because":[{"source_index":0,"quote":"The credits had been supplied free of charge by the unnamed model developer, so the $600,000 represents their commercial value rather than a direct financial loss."}],"event.summary":[{"source_index":0,"quote":"Attackers have stolen an API key from AI safety research organization METR and used it for three weeks to consume model credits that would have been worth about $600,000."},{"source_index":0,"quote":"The incident began in March when a METR researcher ran agents on a personal Amazon EC2 instance made publicly accessible behind Google authentication."},{"source_index":0,"quote":"A fail-open flaw silently disabled authentication, leaving the system exposed for several days."},{"source_index":0,"quote":"The attacker prompted an agent to reveal the model provider API key and added an SSH key for persistence, then used the stolen credentials to consume large volumes of model credits over three weeks."},{"source_index":0,"quote":"METR said the illicit usage was hard to distinguish from legitimate evaluation activity, since its researchers routinely generated high volumes of model traffic, and it had no way to cap spending on free-credit keys."},{"source_index":0,"quote":"The organization revoked the researcher's access, rotated credentials, wiped the laptop and alerted the model developer."},{"source_index":0,"quote":"It said it had found no evidence that sensitive information was accessed in either incident."}]},"notes_on_gaps":"The sources give March as the start month but no year; 2026 is inferred from the article dates and the 31 August disclosure, so date_occurred is recorded as 2026-03. The disclosure date 2026-08-31 is taken from the stated 'Aug 31' with the year inferred from the article date. No detection date, dates for the exposure window or containment, or total credit count is stated, so these are omitted. The $600,000 is described as commercial value of free credits, not a direct financial loss, so direct_loss_usd is omitted. The model developer is unnamed and the model name and version are not stated. Records exposed and third-party counts are not stated; METR reports no evidence sensitive information was accessed. Judgements made: detection_method set to victim because METR itself disclosed the incident; root_cause set to guardrail because the failed control was the authentication (fail-open flaw); responsible_party set to deployer because the researcher ran the agents on a personal instance; severity set to moderate because one third party's credits were consumed over a stated three-week scope; deployment_context set to research from the organisation's description. Control A4 and E3 failures and the A7 gap are taken from the sources; the source does not name the monitoring control, so no monitoring link is recorded beyond the stated lack of spend caps. The Stack article's quote about the security update is not used separately. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: Infosecurity Magazine · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"went_wrong","text":"A fail-open flaw silently disabled authentication, leaving the system exposed for several days.","quote":"A fail-open flaw silently disabled authentication, leaving the system exposed for several days.","source_index":0,"grade":"C"},{"step":"reached","text":"The attacker got an agent to reveal the model provider API key and used it to consume model credits over three weeks.","quote":"The attacker prompted an agent to reveal the model provider API key and added an SSH key for persistence, then used the stolen credentials to consume large volumes of model credits over three weeks.","source_index":0,"grade":"C"},{"step":"done","text":"METR revoked the researcher's access, rotated credentials, wiped the laptop and alerted the model developer.","quote":"The organization revoked the researcher's access, rotated credentials, wiped the laptop and alerted the model developer.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.infosecurity-magazine.com/news/attackers-steal-metr-api-key/","https://www.thestack.technology/how-a-vibe-coded-app-let-hackers-use-600k-worth-of-ai-tokens-at-metr/"]},"analysis":{"sections":{"timeline":[{"text":"Fail-open flaw silently disables authentication; system exposed for several days.","quote":"A fail-open flaw silently disabled authentication, leaving the system exposed for several days.","source_index":0,"when":null},{"text":"Attacker extracts the API key via an agent, adds an SSH key for persistence, and consumes model credits over three weeks.","quote":"The attacker prompted an agent to reveal the model provider API key and added an SSH key for persistence, then used the stolen credentials to consume large volumes of model credits over three weeks.","source_index":0,"when":null},{"text":"METR discloses the incident in a security update.","quote":"METR disclosed the incident in a security update published on Aug 31, alongside highlighting a separate attack in May in which threat actors probed its public infrastructure.","source_index":0,"when":"Aug 31"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.infosecurity-magazine.com/news/attackers-steal-metr-api-key/","https://www.thestack.technology/how-a-vibe-coded-app-let-hackers-use-600k-worth-of-ai-tokens-at-metr/"]}}