Breaking

METR Says Stolen Public-Model API Key Ran About $600,000 in Credits After Fail-Open Dashboard Bug

September 1, 2026 at 05:06 EDT

Security
AI Agents

METR, the nonprofit Model Evaluation and Threat Research, said attackers stole an API key used for inference on public models in March 2026 and spent about three weeks running those models, consuming credits that would have been worth approximately $600,000. The key sat on a personal Amazon EC2 instance hosting a publicly reachable agent orchestration dashboard. A fail-open bug silently disabled Google authentication, after which the attacker prompted an agent to disclose the credential and added an SSH key for lasting access.

August 31, 2026 · METR

Fail-open dashboard, $600,000 API key

Attackers prompted an agent to hand over a public-model key, planted SSH access, and ran inference for three weeks. METR says no sensitive model secrets were taken.

Exposure lasted days. Abuse lasted weeks.

Vertical scale: one block per unit of time. The stolen key kept spending long after the dashboard was first left open.

Several days

Public dashboard window

3 weeks

Stolen-key inference

Takeaway: No spend cap and noisy eval traffic hid a six-figure drawdown.

$600k

List value of credits consumed (granted free)

3 wks

How long the stolen public-model key was used

Notable incidents METR disclosed (March and May)

Category 3–4 secrets METR says were accessed

How the March theft unfolded

Fail-open auth
Google login silently dropped

→

Prompt the agent
Dashboard asked for its API key

→

SSH persistence
Attacker key added on the host

→

Three-week spend
Public-model credits drawn down

Contained, per METR

Only a public-model key was stolen. Credits were complimentary, so there was no $600,000 bill. Category 3 and 4 secrets were not accessed.

What still failed

A vibe-coded app failed open, an agent disclosed its key on request, and high eval volume hid the theft until the three-week mark.

Near-miss, not a clean bill

May’s SQL bug could have reached unpublished evals

Attackers probed the transcript-viewer endpoint. METR says they did not find the exploit or pull non-public data. Some sensitive model output had been stored there by mistake.

Response: API taken offline; bounty paid to the independent reporter
Fix: Isolated public production, spend alerts, review for public researcher apps
Scope: External attackers on METR systems — not agents escaping evaluations

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.