METR discloses security incidents, including a vibe-coded app with silent auth bypass
nptacek · x · 2026-09-01
AI evaluation org METR published a security update detailing two incidents earlier this year: in March, attackers stole an API key for public-model inference and burned substantial credits; in May, attackers systematically probed its public infrastructure, including an unsuccessful attempt to reach internal data via an inadvertently exposed endpoint. METR clarifies these were external attacks, not AI agents hacking during evaluations, and says a scan found no evidence of agents hacking third parties. Security investment has since increased.
The widely shared detail: a vibe-coded app included a fail-open vulnerability that silently disabled authentication.
More from Safety
- One diagram explains the difference between CSRF and XSS attacks — _jaydeepkarale · 2026-10-18
- Grady Booch slams Anthropic for tolerating up to 50 deaths and $1B damages per model — Grady_Booch · 2026-10-18
- Single Neuron Suffices to Bypass Safety Alignment in LLMs, Paper Finds — burny_tech · 2026-10-18
- Polymarket gives OpenAI just 8% odds of a full training pause by end of 2026 — Polymarket · 2026-10-18
- OpenAI engineer over alleged hidden recording device seeks bail, denies Saudi escape plan — Polymarket · 2026-10-18
- Free comic "The Collective" offers a strange retelling of the Hugging Face hack — Flugelwagen · 2026-10-18