Attackers stole METR API keys and burned ~$600K in credits over three weeks

METR, a nonprofit that evaluates frontier AI models, has disclosed a security incident: in March 2026, a researcher's public agent dashboard left Google authentication silently disabled for several days due to a fail-open flaw, exposing it to the public internet. An attacker used prompt injection to trick the agent into handing over its API key and planted an SSH persistence backdoor, burning roughly $600,000 in credits over about three weeks. The incident was first reported by @beffjezos and covered by security outlet The Hackers News, with multiple accounts resharing consistent information.

Confirmed

• The incident occurred in March 2026, officially disclosed by METR, involving two security incidents in total
• The root cause was a fail-open flaw in the public agent dashboard: when authentication failed, the system continued to allow access instead of denying it
• The attacker used prompts to induce the agent to leak its API key and added an SSH persistence backdoor
• The stolen key was an AI service key, abused to consume roughly $600,000 in credits over three weeks

Why it matters

• This is a real-world case of an "AI agent being directly used in an attack": the attack surface was not a traditional system vulnerability, but a conversation that got the agent to surrender its own credentials, highlighting the risks of agent permissions and credential management
• The fail-open design (allowing access even when authentication fails) is seen as the most direct lesson: security-critical paths should fail closed
• The incident has also raised questions about the security of evaluation organizations themselves: in a discussion with @beffjezos, user @sierracatalina argued that safety evaluations in the style of "METR will save us" are merely theater for labs to dodge legal liability, and that AI hacking the evaluator directly proves the only truly safe option is local deployment; this is a personal opinion, but it reflects ongoing debate over the credibility of centralized evaluations

2026-09-14 ~ 2026-09-14 · 5 related posts

• [source] Stolen METR API key burned ~$600,000 in credits over three weeks; critics mock the AI-safety eval org — AlexTensor · 2026-09-14
• METR API key stolen and abused for three weeks, racking up ~$600,000 in credits — Kyrannio · 2026-09-14
• Stolen METR API key burned ~$600,000 in three weeks via a fail-open auth bug — nptacek · 2026-09-14
• [source] Attackers Stole METR API Key and Burned ~$600,000 in AI Credits Over Three Weeks — beffjezos · 2026-09-14
• [source] AI safety skeptic calls METR evaluations 'security theatre', backs local open-source models — sierracatalina · 2026-09-14