Attackers Steal METR API Key and Burn $600,000 in AI Credits

ATTACKERS stole an API key from AI safety research organization METR, consuming $600,000 worth of model credits over three weeks. The breach occurred due to a flaw in authentication on a public EC2 instance where the key was stored. METR confirmed no sensitive data was accessed and has since implemented new security measures, including rotating credentials and monitoring. A previous attack in May involved attempts to exploit the organization’s public infrastructure, but no vulnerabilities were successfully breached.