AI safety nonprofit METR says attackers stole an API key and burned about $600,000 in model credits across two incidents.