METR discloses two 2026 security incidents, including a $600,000 API key theft

AI safety research nonprofit METR disclosed two 2026 security incidents in a blog post published on August 31, 2026, saying attackers stole an API key and separately probed its infrastructure.

The API-key theft let an attacker consume AI model credits worth about $600,000 over three weeks, while a second campaign exposed a bug that could have reached unpublished evaluation data.

What happened

In March 2026, a METR researcher ran agents on a personal Amazon EC2 instance intentionally made publicly accessible behind Google authentication, and the instance held an API key for METR's public-models account.

A fail-open bug in the vibe-coded app silently disabled authentication, exposing the system to the public internet for several days.

The attacker prompted an agent directly to reveal its model provider API key, added an SSH key for persistent access, and over three weeks used the stolen credentials to consume a significant amount of API credits on publicly available models.

In May 2026, METR said attackers ran a sustained campaign using agents for credential stuffing, OAuth token-grant attempts, service scanning and staff phishing, and it inadvertently exposed a read-only SQL query mechanism through its public transcript viewer.

Impact

METR said the stolen credits would have been worth approximately $600,000, though the model developer had granted them to METR for free, and the organization said it believed no sensitive information was accessed in either incident.

Response

METR said it immediately revoked the researcher's access, rotated credentials, and imaged and wiped the affected laptop, while alerting the relevant model provider.

For the May incident, an independent security researcher disclosed the transcript-viewer bug, and METR took the API offline and paid a bounty.

METR said it hired a security lead, plans to expand its security staff further, and now runs public-facing applications in an environment architecturally separated from its internal infrastructure.

Lessons for security leaders

The incidents show that free or unmetered model credits can mask large-scale credential theft when no spend limit or usage alerting exists, and that security leaders working with AI model evaluators should ask how sensitive model data is classified and whether public-facing services are segmented from internal systems.