AI Model Evaluator METR Hit by Credential Theft, Probing

Attackers stole an API key (a credential that grants access to services) from METR, a security nonprofit that evaluates AI models, which allowed them to use $600,000 worth of public AI model credits without authorization. The breach demonstrates how a single compromised credential can lead to significant financial damage by enabling unauthorized consumption of cloud resources.