THE METR organization, known for its AI safety evaluations, reported a significant security breach where stolen API credentials led to the unauthorized consumption of approximately $600,000 in AI credits over 20 days. The breach occurred due to an authentication failure that left an agent dashboard exposed on the internet. Attackers exploited this vulnerability to access the API credentials, which they may have sold.
The incident went undetected for a long time due to METR's high volume of API credit usage and limitations on spending caps. Additionally, METR faced ongoing scanning attacks aimed at identifying vulnerabilities in its infrastructure, although a potential SQL exposure was responsibly disclosed before any data was compromised.