Stolen METR API key burned ~$600,000 in credits over three weeks via fail-open auth bug
nptacek · x · 2026-09-15
Per TheHackersNews, attackers stole an API key from eval org METR and burned roughly $600,000 in credits over three weeks. The entry point: a public agent dashboard had a fail-open bug that disabled Google authentication. The attacker used prompt injection to make an agent reveal the key, then added SSH persistence.
In the quoted retweet, @EMostaque notes that eval orgs like METR will face nation-state-level attacks and need both world-class AI talent and world-class cybersecurity — fields that, in his experience, barely overlap.
Related event: METR Breached: Attackers Burn ~$600K in API Credits Over Three Weeks(9 posts)→
More from AGI Musings
- Five agents can agree because they made the same mistake, krishnan warns with satire — krishnan · 2026-10-31
- Google's earnings offer clearest look yet at the cruel economics of AI search — dinabass · 2026-10-31
- Stanford 12-month study of 439 users: heavy AI companion use sticks, well-being drops via less human contact — stanfordnlp · 2026-10-31
- Wired AI Lab: Codex tried to bench Erling Haaland in a fantasy football experiment — willknight · 2026-10-31
- a16z: B300 GPU rentals up 106% since July while average token prices fall 58% — a16z · 2026-10-31
- Stanford's TaskNet builds occupational task inventories from worker interviews at scale — stanfordnlp · 2026-10-31