Stolen METR API Key Burned ~$600K Over Three Weeks After Fail-Open Auth Bug Exposed Agent Dashboard
nptacek · x · 2026-09-14
Attackers stole a METR API key and consumed about $600,000 in credits over three weeks. A fail-open bug disabled Google authentication on a public agent dashboard, letting the attacker prompt the agent into revealing the key and adding SSH persistence. Critics slam METR for not noticing for weeks.
Related event: METR Breached: Attackers Burn ~$600K in API Credits Over Three Weeks(9 posts)→
More from Safety
- Frog and Toad meme nails the HSM paradox: keys stay safe, but compromised servers can still sign — rickasaurus · 2026-10-31
- Heads Of Security: paper pinpoints and rewires attention heads behind prompt injections — jonasgeiping · 2026-10-31
- House Democrats resolution: no bailouts for failing AI companies — your data goes to bankruptcy court — alex_verem · 2026-10-31
- Amazon Echo kills local voice storage: everything goes to the cloud from March 28 — alex_verem · 2026-10-31
- DOJ's first crackdown on AI-assisted "ghost students" seizes $750K+ in crypto — Ars Technica AI · 2026-10-31
- Researcher Finds 600+ Bugs in LLM Kernel Code; Claude Blocks Safety Analysis — pmddomingos · 2026-10-31