Stolen METR API key burned ~$600,000 in three weeks via a fail-open auth bug
nptacek · x · 2026-09-14
Attackers exploited a fail-open bug that disabled Google authentication on a public agent dashboard, prompted an agent into revealing METR's API key, and added SSH persistence—then spent roughly $600,000 in credits over three weeks. The report was amplified by a16z's Martin Casado, spotlighting agent deployment security failures.
Related event: METR Breached: Attackers Burn ~$600K in API Credits Over Three Weeks(9 posts)→
More from Safety
- Frog and Toad meme nails the HSM paradox: keys stay safe, but compromised servers can still sign — rickasaurus · 2026-10-31
- Heads Of Security: paper pinpoints and rewires attention heads behind prompt injections — jonasgeiping · 2026-10-31
- House Democrats resolution: no bailouts for failing AI companies — your data goes to bankruptcy court — alex_verem · 2026-10-31
- Amazon Echo kills local voice storage: everything goes to the cloud from March 28 — alex_verem · 2026-10-31
- DOJ's first crackdown on AI-assisted "ghost students" seizes $750K+ in crypto — Ars Technica AI · 2026-10-31
- Researcher Finds 600+ Bugs in LLM Kernel Code; Claude Blocks Safety Analysis — pmddomingos · 2026-10-31