METR hacked for 3 weeks, attackers drained ~$600,000 in API credits
Hesamation · x · 2026-09-15
AI evals nonprofit METR was breached for three weeks without noticing, with attackers stealing an API key and consuming roughly $600,000 in credits. Details from TheHackersNews: a fail-open bug disabled Google authentication on a public agent dashboard; the attacker prompted an agent into revealing the key and added SSH persistence.
ThePrimeagen mocked the irony: labs rely on METR to validate AI safety, yet the safety org itself went three weeks without detecting the intrusion.
Related event: METR Breached: Attackers Burn ~$600K in API Credits Over Three Weeks(9 posts)→
More from Safety
- Cryptographer Matthew Green: Anthropic's agent worm framing is unhelpful, we need a simulated one to know — matthew_d_green · 2026-10-30
- macOS update silently re-adds eMudhra root certs users had removed — steipete · 2026-10-30
- Akamai: Online Scams Double to 6.4M, Overtake Phishing as Attack Windows Shrink to 22 Days — shashib · 2026-10-30
- Anthropic paper: 0.1% pretraining poison plants RCE backdoor in 4B CLI agent — omarsar0 · 2026-10-30
- Cryptographer Matthew Green slams Anthropic's 'model escape' framing of agent worm research — matthew_d_green · 2026-10-30
- Pope Leo calls to 'disarm' AI and urges UN to ban lethal autonomous weapons — The Verge AI · 2026-10-30