Stolen METR API key burned ~$600K in three weeks; evaluator gift ties questioned
nptacek · x · 2026-09-15
Attackers exploited a fail-open bug that disabled Google auth on a public agent dashboard, tricked the agent into revealing a METR API key, and added SSH persistence — burning roughly $600,000 in credits over three weeks. BabyAGI creator Yohei Nakajima also raises conflict-of-interest concerns about third-party evaluators accepting undisclosed gifts.
Related event: METR Breached: Attackers Burn ~$600K in API Credits Over Three Weeks(9 posts)→
More from Companies & People
- Trader argues selloff ignores Google's AI trap: no way back to Search — JOBhakdi · 2026-10-31
- Newsletter Offers $600 per Article for CS Research Paper Columnists — AustinZHenley · 2026-10-31
- The IT skills shortage is really a complexity crisis in disguise — DavidLinthicum · 2026-10-31
- Paying $600 per article to turn CS papers into monthly columns, remote — littmath · 2026-10-31
- "The moat is obviously Anthropic's": investor weighs in on SpaceX–Anthropic deal economics — firstadopter · 2026-10-31
- Kai-Fu Lee's 'AI Native' ships Nov 3 with endorsement from Satya Nadella — kaifulee · 2026-10-31