Cases › security breach › LR-2026-0732
Attackers steal METR API key and burn $600,000 in AI credits
Preliminary Why: 1 report: Infosecurity Magazine · subject to change · 1 independent report
Status: action reported, no fix
No source states: loss or records, developer and model, agent tool, could do, deployer, industry.
Severity moderate: test: a third party's systems were touched (the model developer's credits were consumed), with a bounded scope stated as three weeks; the $600,000 is commercial value, not direct loss.
An API key for METR's public models account, held in a researcher's vibe-coded app on a personal cloud instance, was stolen and used for about three weeks to consume model credits that the sources value at about $600,000. The instance had been made publicly accessible behind Google authentication, and a fail-open flaw silently disabled that authentication, leaving it exposed for several days. The attacker prompted an agent to reveal the provider API key and added an SSH key for persistence. METR said the illicit usage was hard to distinguish from legitimate evaluation activity, and that it had no way to cap spending on free-credit keys. The sources do not say how the misuse was first detected. METR revoked the researcher's access, rotated credentials, wiped the laptop, alerted the model developer and later added spend alerts. METR said it had found no evidence that sensitive information was accessed in either incident.
What happened
What was done
Risks
Read from the sources; not yet reviewed by a person.
Controls
Not yet read for controls. Controls that mitigate the primary risk:
ApplicationShort-lived, scoped credentials · Secrets kept out of the model's context · Separate identity for each agent · Least-privilege access for the agent · Alerts on unusual tool use · Activity logs · Sensitive-data checks on outbound data
Infrastructure / targetSimilar incidents
Evidence
No source states: what the AI was doing, how it was caught, when it happened, when it was found, how many records were exposed, a count of the other parties affected, any court case, the cause, what set it off.
Show the full account: 3 items from the primary sources
What happened, in order
- Aug 31 METR discloses the incident in a security update.
Not dated in the sources:
- Fail-open flaw silently disables authentication; system exposed for several days.
- Attacker extracts the API key via an agent, adds an SSH key for persistence, and consumes model credits over three weeks.
Show every field, with its source and grade
What happened
Impact
Notes on gaps
The Stack article's quote about the security update is not used separately.
LR-2026-0732 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON