METR Incident: Attacker Simply Asked an Exposed Agent for Its API Key, Burned $600k in Credits
Round-Metal6269 · reddit · 2026-11-12
METR's security write-up details how an agent dashboard on a personal EC2 box failed open due to a bug, letting an attacker (likely found via certificate transparency logs) prompt the agent to reveal its API key, add an SSH key for persistence, and burn $600k of free credits over three weeks unnoticed. The post distills a practical checklist: test for fail-open auth, ask your own agent to print env vars, keep keys behind a capped proxy, put dashboards behind Cloudflare Access/Tailscale, and check your domains on crt.sh.
More from coding & agent
- Agent reads email threads and pre-books your apartment viewing on Gcal automatically — braelyn_ai · 2026-11-12
- AntiFox AI Pentesting Platform Linked to Attacks That Stole AWS Production Secrets — Thionne_WTZ · 2026-11-12
- AFK Pilot ships standalone desktop app to run coding agents without an IDE — PawelHuryn · 2026-11-12
- AFK Pilot extension unifies 6 coding agents incl. Gemini 4 Carbon, tops 180K installs — PawelHuryn · 2026-11-12
- StepFun hosts Agent Night Out in SF on long-running agent costs, demos Step 5 Preview — StepFun_ai · 2026-11-12
- Reflection's Beam free until Nov 12; fx is a 5.97MiB Zig-native open coding agent — evilrabbit_ · 2026-11-12