Attackers Stole METR API Key and Burned ~$600,000 in AI Credits Over Three Weeks
beffjezos · x · 2026-09-14
METR, the nonprofit that evaluates frontier AI models, disclosed two security incidents. In March 2026, a fail-open bug silently disabled Google auth on a researcher's public agent dashboard, letting attackers prompt an agent into revealing an API key, add SSH persistence, and consume $600,000 in inference credits over three weeks. In May, attackers probed its infrastructure; no sensitive data was accessed. beffjezos (Guillaume Verdon) mocked it as security theatre, arguing only local open-source models offer real safety.
Related event: METR Breached: Attackers Burn ~$600K in API Credits Over Three Weeks(9 posts)→
More from AGI Musings
- Will Manidis publishes 'The Commanding Heights' on AI, capital and the coming economic reordering — round · 2026-10-31
- "Work on something so frontier that the models are still dumb," dev advises — zack_overflow · 2026-10-31
- Why an AI military takeover is unlikely: armies won't hand over the reins — S_OhEigeartaigh · 2026-10-31
- Indian dev on LLM race: 'We can't outspend Chinese labs,' even sub-100B models win — PrasoonPratham · 2026-10-31
- Joke: an evil ASI's first act would be stealing crypto to pay its cloud bills — ZeroStateReflex · 2026-10-31
- DHH on living through two epochal shifts: the internet and now AI — Hesamation · 2026-10-31