Attackers Steal METR API Key and Burn $600,000 in AI Credits

METR disclosed that attackers stole an API key from a researcher’s publicly exposed environment and used it for three weeks to consume about $600,000 worth of model credits; a separate campaign probed METR’s public infrastructure using automated agents and scanned for vulnerabilities, including a disclosed read-only SQL query bug that could have exposed unpublished evaluation data. METR found no evidence of sensitive data exfiltration, revoked and rotated credentials, removed access, paid a bounty for the disclosed bug, and separated public-facing applications from internal infrastructure.