Stolen METR API key burned ~$600,000 in credits over three weeks; critics mock the AI-safety eval org
AlexTensor · x · 2026-09-14
Attackers exploited a fail-open bug that disabled Google auth on a public METR agent dashboard, prompting an agent to reveal an API key and adding SSH persistence. The key was used for three weeks, burning roughly $600,000 in credits. Andrew Orlowski mocks METR's competence given Dario Amodei's reliance on the org for AI safety evaluations.
Related event: METR Breached: Attackers Burn ~$600K in API Credits Over Three Weeks(9 posts)→
More from Safety
- OpenAI reportedly to train on users' Daybreak sessions with no opt-out — dyn___ · 2026-10-31
- Forethought: US has 9x China's AI compute, can afford to pace the frontier — willmacaskill · 2026-10-31
- unpromptedconf takeaways: security programs face forced change as reachable vulnerabilities can't be risk-accepted — scottleibrand · 2026-10-31
- Reachable vulnerabilities can't be risk-accepted away, unpromptedconf speaker argues — scottleibrand · 2026-10-31
- AI safety researchers argue labs' silence on x-risk is a large-scale ethical mistake — DavidSKrueger · 2026-10-31
- AI agent Muse reportedly created Windows user accounts without consent — tHE_uKER · 2026-10-31