Stolen METR API key burned ~$600K in credits via fail-open agent dashboard bug
GaryMarcus · x · 2026-09-02
A fail-open bug disabled Google authentication on a public agent dashboard, letting attackers prompt an agent into revealing METR's API key and adding SSH persistence. The key was abused for roughly three weeks, consuming about $600,000 in credits. Gary Marcus shared the incident as more evidence that vibe coding without security review is a real risk.
More from Safety
- David Sacks: Anthropic blocking 90-99% of distillation proves regulation was never needed — AlexTensor · 2026-10-18
- Friends don't let friends feed their data to AI agents: Verge on Muse AI consent — IndependentCoast3974 · 2026-10-18
- Redditor proposes AI regulation framework: text detection, face verification, open algorithms — techtotechbytechy · 2026-10-18
- Prompt injection via email can hijack your AI agent — jev-guard adds risk-scored guards — sujingshen · 2026-10-18
- Users press OpenAI on long-delayed Adult Mode a year after it was promised — ___Patrice___ · 2026-10-18
- Viral AI safety report debunked: 'stolen keys' were just a 'test' string — basedjensen · 2026-10-18