The AI safety research organization METR has disclosed two separate security incidents, one in March and another in May, neither of which resulted in evidence of sensitive information access. The more significant event involved attackers stealing an API key and using it for three weeks to consume approximately $600,000 worth of AI model credits, which had been provided free of charge by an unnamed model developer.
The March incident began when a METR researcher operated agents on a personal Amazon EC2 instance that was publicly accessible and secured by Google authentication. This application, described as "vibe-coded," contained an API key for METR's public models account. A "fail-open" flaw in the authentication mechanism silently disabled it for several days, leaving the system exposed. METR suspects the attackers located the instance by analyzing certificate transparency lists for recently registered sites containing terms related to language models and agents.
Once access was gained, the attackers prompted an agent to reveal the model provider API key and established persistence by adding an SSH key. They then utilized these stolen credentials to generate a high volume of model traffic over three weeks. This illicit activity was difficult to distinguish from legitimate evaluation work, as METR researchers routinely generate significant model traffic, and there was no spending cap on free-credit keys. In response, METR revoked the researcher's access, rotated credentials, wiped the affected laptop, and notified the model developer. The organization has since implemented spend alerts for keys where feasible.
In a separate incident in early May, METR received a tip-off about financially motivated attackers targeting its public infrastructure, potentially seeking access to frontier models. These attackers extensively used agents to automate vulnerability discovery, including credential stuffing, attempts to grant OAuth tokens, scanning new services, and phishing attempts against staff.
During this period, METR also inadvertently exposed a read-only SQL query mechanism through its public transcript viewer. A bug in this mechanism could have allowed access to unpublished evaluation data, and the database itself had been accidentally loaded with sensitive model data it was not intended to hold. An independent researcher discovered and disclosed this flaw, prompting METR to take the interface offline and issue a bounty. METR confirmed that while the attackers probed this endpoint, there was no indication they discovered or exploited the bug.
METR has since implemented architectural separation, running public-facing applications in an environment distinct from its internal infrastructure. The organization stated its broader security measures were accurate as of July 30.
