AI safety nonprofit METR has disclosed two security incidents in which outsiders tried to break into its systems. The group says no sensitive information was accessed and the attacks have not been attributed to any known threat actor.
In March, an attacker stole an API key for public models and burned a substantial volume of credits. METR estimates the usage would have produced roughly $600,000 in bills had the model provider not supplied them for free. The key sat on a researcher’s personal EC2 instance inside a “vibe-coded” dashboard whose fail-open flaw silently disabled authentication, exposing the app to the public internet for days. The intruder likely found it by scanning certificate transparency lists for LLM-related sites, then prompted an agent to reveal the key, added an SSH key for persistence, and kept spending for three weeks before the anomaly surfaced.
A second campaign in May featured sustained probing: credential stuffing, OAuth token attempts, scans of new services, and phishing aimed at staff. METR also acknowledged an inadvertently exposed SQL query endpoint in its public transcript viewer that could have reached unpublished evaluation data, plus a database that “accidentally included” sensitive model data. An independent researcher discovered the flaw first; evidence suggests the attackers probed the endpoint but never exploited it.
METR has since barred its credentials from non-METR infrastructure, added spend alerts, and tightened monitoring. The incidents highlight how AI labs with high token budgets are becoming prime targets for credential harvesting.
