METR

Summary

An attacker exploited a fail-open flaw in a researcher's publicly accessible instance to steal an API key belonging to METR, an AI safety research organization. Over three weeks, the threat actor used the stolen credentials to consume roughly $600,000 worth of model credits supplied by the unnamed provider. A separate flaw in a public transcript viewer could have exposed unpublished evaluation data, though the organization found no evidence that sensitive information was accessed in either incident.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In March 2026, a researcher at the AI safety organization METR ran agents on a personal Amazon EC2 instance that was made publicly accessible behind Google authentication, according to a security update the organization published on August 31, 2026. The researcher had built the application by "vibe-coding," and the app held an API key for METR's public models account. Because of a flaw in the authentication setup, the system silently failed open rather than blocking unauthorized users. The instance remained exposed in this state for several days, during which time METR believes an attacker discovered it by mining certificate transparency logs for recently registered domains whose names contained high-signal terms associated with language models and agents. Once the attacker found the host, they used an agent to extract the model provider's API key from the application's environment. To maintain long-term access, the attacker also added an SSH key to the instance for persistence. With the stolen API key, the attacker then spent roughly three weeks generating enormous volumes of model traffic against the provider's services, consuming free credits that would have carried a commercial value of approximately $600,000. METR stated that the credits had been provided to it free of charge by the unnamed model developer, so the figure represented market value rather than a direct monetary loss to METR itself. Detecting the abuse was particularly difficult because the stolen key was being used to drive evaluation-style traffic that closely resembled the high-volume workloads METR researchers generate as part of their normal work, and the organization noted it had no mechanism in place to cap spending on free-credit API keys.

Separately, METR disclosed that in early May 2026 it received a tip indicating it was being targeted by attackers who appeared financially motivated and may have been attempting to obtain access to frontier AI models. In response to that warning, METR reviewed its public infrastructure and discovered probing activity that suggested the attackers had been scanning newly issued services, attempting credential stuffing attacks, testing OAuth token grant flows, and trying to phish METR staff. The attackers leaned heavily on AI agents to automate large portions of this reconnaissance and exploitation work, which let them iterate quickly across many targets. METR determined that the stolen API key incident and the May probing campaign were both the work of external attackers rather than rogue behavior by AI agents inside its own evaluation harness; an initial scan of its evaluations found no evidence that internal agents had attempted to hack any third parties.

During the investigation, METR also discovered a separate vulnerability in its public transcript viewer, which unintentionally provided a SQL query interface to visitors. The interface was intended to be read-only, but a bug in it could have allowed an attacker to reach unpublished evaluation data. METR also found that the database backing the viewer had accidentally been loaded with sensitive model information it was never supposed to hold. The flaw was reported to METR by an independent researcher through its bug bounty program; METR paid a bounty and took the transcript viewer interface offline. The organization noted that the attackers linked to the other incidents had probed the same endpoint but did not appear to discover or successfully exploit the underlying bug.

After confirming that the API key had been abused, METR revoked the compromised researcher's access, rotated the affected credentials, and wiped the researcher's laptop as a precaution. The organization also alerted the model provider that had issued the free credits about the compromise. Where the provider's tooling supported it, METR subsequently added spend alerts to API keys so that unusually high usage would generate timely notifications. METR also reported that, in the security update published on August 31, it had found no evidence that sensitive information was accessed in either the API key incident or the May probing campaign, and it stated that the disclosure covered external attackers only. Following these events, METR changed its deployment model so that public-facing applications run in an environment that is architecturally separated from its internal infrastructure, reducing the risk that a compromise of a publicly accessible system could lead to access to internal systems or data. The organization's published description of its wider security controls was stated to be accurate as of July 30, 2026, and the incidents involving the stolen API key, the May probing, and the transcript viewer bug remained the principal events documented in the disclosure.

Sources

Sources available to members: 1 source.