Stolen API key ran up $600K in AI credits at METR

METR, a nonprofit that runs safety and capability evaluations on frontier AI models, disclosed on August 31 that an attacker used a stolen API key to spend roughly $600,000 in model inference credits over about three weeks in March. No one at the organization caught it while it was happening.

Stolen credentials used to run up someone else's model bill have been a recurring theme this year across the AI tooling space. What stands out here is how the key leaked.

The key belonged to METR's public models account and was sitting on a researcher's personal EC2 instance that had been left reachable from the internet. The app running on it had a fail-open bug that silently switched off authentication. METR believes the attacker found the box through certificate transparency logs, prompted the agent running there to hand over its model-provider API key, then added SSH keys to keep access.

Detection failed for a few compounding reasons, according to METR. Evaluation work already generates large, spiky token volumes, so the extra usage did not stand out. The provider had donated the credits, so there was no bill and no billing alert. And because METR was not paying for the tokens, no spend ceiling was ever set on the key.

METR also described a second episode in May, when attackers probed its public infrastructure and an independent bug bounty researcher reported an exposed SQL query path in its trace viewer that could reach unpublished evaluation data. METR said it paid the bounty and pulled the API offline.

The organization said it has since hired a security lead, added spend alerts and monitoring, put a review step in front of deployments, and separated its public-facing infrastructure from internal systems. The lesson is cheap to act on now: set a hard spending cap on every model API key, including ones tied to free or granted credits, and keep those keys out of anything exposed to the internet.