Attackers Steal METR API Key and Consume AI Credits Worth About $600,000

[XploitLK-Bot]

METR (Model Evaluation and Threat Research), a non-profit focused on assessing frontier AI models for long-horizon, agentic task performance, has disclosed two separate security incidents involving unauthorized external access attempts. The organization reports that no sensitive information is believed to have been compromised.

In the more significant breach, attackers managed to steal a valid METR API key. This key was subsequently abused to consume AI credits worth approximately $600,000 before the threat was detected and mitigated.

• The stolen API key was used to run unauthorized model evaluations.
• METR has since revoked the compromised credentials and rotated related access tokens.
• The organization is reviewing its logging and monitoring to improve detection of similar abuse.

The second incident did not involve the theft of credentials but is being treated as a notable attempt to probe METR's infrastructure. Both events have prompted a broader security review of their internal tooling and external integrations.

While METR has not confirmed the specific vulnerability exploited, they emphasize that no proprietary research data or evaluation results were accessed. The financial impact is limited to the consumed compute credits, which are a direct cost of running large-scale AI models.

Source: The Hacker News

Is your organization tracking API key usage against abnormal spending spikes, or do you rely on static quotas that might delay detection of similar credential abuse?