AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

Attackers Steal METR API Key and Consume AI Credits Worth About $600,000

highnewsLLM-Specific

security

Source: The Hacker NewsSeptember 1, 2026

Summary

METR, a research organization that tests AI systems, disclosed two security incidents in 2026 where attackers stole an API key (a credential that grants access to AI services) and ran up about $600,000 in unauthorized charges on AI models, and separately probed its systems for vulnerabilities. The first attack exploited a fail-open vulnerability (a security flaw where authentication is accidentally disabled) on a researcher's publicly accessible server, while the second involved systematic scanning and phishing attempts to gain access to frontier AI models.

Solution / Mitigation

Following the March incident, METR updated its security policies to restrict storing credentials on non-METR infrastructure, improved monitoring of suspicious activity, and added spend alerts to API keys where possible. For the May incident, METR addressed the exposed SQL query mechanism and the bug that could have allowed access to unpublished data, though the source does not specify the exact remediation steps taken.