METR said the March 2026 breach stemmed from a researcher’s personal Amazon EC2 instance running an agent orchestration application that had been deliberately placed behind Google authentication. A fail-open flaw in the “vibe-coded” application silently disabled that authentication, leaving the system exposed to the public internet for several days.
The non-profit, formally Model Evaluation and Threat Research, said the compromised instance contained an API key linked to its general-access account for publicly available AI models. After finding the exposed service, the attacker prompted an agent directly to reveal the model provider’s API key, added an SSH key to maintain persistent access and then used the stolen credentials for roughly three weeks.
The credits consumed would have carried a commercial value of about $600,000, according to METR. The unnamed model developer had provided those credits free of charge, meaning the incident did not leave METR with a $600,000 bill. The organisation said its investigation found no compromise beyond the single stolen API key.
METR said it suspects the attacker discovered the exposed instance by searching newly registered websites, including certificate transparency data, for sites containing terms associated with large language models or AI agents. The organisation described that explanation as its assessment rather than an established account of how the system was located.
The illicit activity went undetected partly because METR routinely conducts evaluations and experiments that generate unusually high token volumes. Researchers are accustomed to large numbers of rate-limit warnings and other API errors, some of which do not indicate extraordinary usage. Its internal usage dashboard at the time also did not display rate-limited requests to all users, while the free credits meant there was no natural spending ceiling. METR said it had no available mechanism then to impose a spending limit on keys of that type.
Once staff determined that the surge in model usage was not connected to an evaluation, METR traced it to the researcher’s personal instance. The organisation revoked the researcher’s access, stopped and imaged the EC2 instance, rotated credentials found there, and imaged and wiped the researcher’s laptop. It also alerted the partner AI company whose models were involved.
Security consultancy Calif carried out a separate compromise assessment, while METR performed manual and agent-assisted forensic work to determine the scope of the incident. The organisation said those checks supported its conclusion that sensitive information had not been accessed.
The disclosure, published on August 31, also detailed a separate security incident in May, when attackers systematically probed METR’s publicly accessible infrastructure. METR said the campaign appeared financially motivated and may have been aimed at obtaining access to frontier AI models.
During that period, attackers used automated techniques to test authentication providers, attempt OAuth token grants, scan newly deployed services and target staff with phishing attempts. METR also discovered that a public transcript viewer had inadvertently exposed a read-only SQL query mechanism. A bug could, in principle, have allowed access to unpublished evaluation data, and some sensitive model output data had mistakenly been included in the affected database.
An independent security researcher found the vulnerability and disclosed it responsibly to METR, which took the API offline and paid a bounty. METR said the attackers had probed the endpoint as part of their wider campaign but that available evidence showed no indication they discovered the exploit or accessed non-public data.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
