Skip to content
METR API Key Theft Results in $600,000 Credit Loss

METR API Key Theft Results in $600,000 Credit Loss

First seen 1 Sep 2026, 09:59 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •September 2, 2026 at 09:46 UTC
  • •Attackers stole an API key, consuming $600,000 in AI credits over three weeks.
  • •The exposure was due to a fail-open vulnerability in a personal EC2 instance.
  • •No sensitive data was accessed in either of the two reported incidents.

In March 2026, attackers stole an API key from METR, a cybersecurity research organization, and used it to consume $600,000 worth of AI model credits over three weeks. The key was exposed due to a fail-open vulnerability in a personal EC2 instance used by a METR researcher. METR confirmed that no sensitive information was accessed during this incident or a subsequent attack in May, where attackers probed its public infrastructure. The organization has since improved security measures, including revoking access and adding spend alerts to API keys. The attacks were not attributed to any known threat actor or AI agents. METR's security update indicated that it is enhancing monitoring and security policies to prevent future incidents.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 45d ago How this analysis works

Timeline

2026-03-01
API key stolen from METR
Attackers exploited a fail-open vulnerability in a personal EC2 instance, leading to unauthorized consumption of AI credits.
Infosecurity-Magazine
2026-05-01
Attackers probe METR's public infrastructure
Threat actors attempted to access internal data through an exposed endpoint but did not succeed.
The Hacker News
2026-08-31
METR discloses security incidents
METR published a security update detailing the API key theft and probing attempts, confirming no sensitive data was accessed.
metr.org

More articles in this cluster (7)

Following this threat?

Track METR in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (11)

1 / 4