Stolen METR API key burned ~$600,000 in credits over three weeks via fail-open auth bug
nptacek · x · 2026-09-15
Per TheHackersNews, attackers stole an API key from eval org METR and burned roughly $600,000 in credits over three weeks. The entry point: a public agent dashboard had a fail-open bug that disabled Google authentication. The attacker used prompt injection to make an agent reveal the key, then added SSH persistence.
In the quoted retweet, @EMostaque notes that eval orgs like METR will face nation-state-level attacks and need both world-class AI talent and world-class cybersecurity — fields that, in his experience, barely overlap.
Related event: METR Breached: Attackers Burn ~$600K in API Credits Over Three Weeks(9 posts)→
More from AGI Musings
- Box CEO Aaron Levie: AI progress is 'going vertical,' widening the frontier gap — rohanpaul_ai · 2026-10-31
- Model Collapse May Not Hit LLMs, But Perhaps Human Culture or Souls — generativist · 2026-10-31
- Nina Schick: who builds intelligence and how it's distributed is the defining question of our lives — NinaDSchick · 2026-10-31
- Cheap intelligence is like cheap bread — an ingredient list satire of mass-produced AI — jsuarez · 2026-10-31
- Two futures for the young in 2026: 511 job rejections by chatbot vs unlimited AI to rebuild Cisco — PeterDiamandis · 2026-10-31
- Terence Tao warns AI is nearing a dangerous threshold as models start cheating — haider1 · 2026-10-31