Full Report
METR (short for Model Evaluation and Threat Research and pronounced "Meter"), a research non-profit that evaluates frontier artificial intelligence (AI) models for their ability to carry out long-horizon, agentic tasks, disclosed that it suffered "two notable security incidents" where external actors attempted to gain unauthorized access to its systems. No sensitive information is believed to
Analysis Summary
# Incident Report: Unauthorized API Access and Infrastructure Probing at METR
## Executive Summary
METR, an AI safety research non-profit, disclosed two separate security incidents occurring in early 2026 involving the theft of an API key and a sustained campaign of infrastructure probing. The primary impact was the unauthorized consumption of approximately $600,000 worth of AI model credits, though no sensitive research data or internal model weights are believed to have been compromised. The incidents highlighted vulnerabilities in "vibe-coded" experimental applications and gaps in credit monitoring for large-scale AI evaluations.
## Incident Details
- **Discovery Date:** Late March 2026 (Incident 1); May 2026 (Incident 2)
- **Incident Date:** March 2026 – May 2026
- **Affected Organization:** METR (Model Evaluation and Threat Research)
- **Sector:** Technology / AI Research (Non-profit)
- **Geography:** Global / Cloud-based (AWS EC2)
## Timeline of Events
### Initial Access
- **Date/Time:** March 2026
- **Vector:** Fail-open authentication vulnerability on a "vibe-coded" web application.
- **Details:** A researcher’s personal EC2 instance, intended to be behind Google Auth, suffered a silent authentication failure. Attackers discovered the site via Certificate Transparency lists and navigated to the exposed agent dashboard.
### Lateral Movement
- **Details:** The attacker prompted an active AI agent within the dashboard to reveal its hardcoded model provider API key. The attacker also added their own SSH key to the instance to ensure persistent access to the environment.
### Data Exfiltration/Impact
- **Details:** While no sensitive data was stolen, the attackers used the stolen API key to run external workloads. Over three weeks, they consumed AI credits valued at ~$600,000.
### Detection & Response
- **Incident 1:** Detection was delayed due to the lack of spend alerts and the high baseline of legitimate token usage during evaluations.
- **Incident 2:** In May 2026, METR detected a "sustained external attack campaign" involving credential stuffing and phishing.
- **Vulnerability Disclosure:** An independent researcher reported an exposed SQL endpoint in the public transcript viewer, which METR then took offline.
## Attack Methodology
- **Initial Access:** Exploitation of misconfigured authentication (fail-open) on a public-facing EC2 instance.
- **Persistence:** Implementation of unauthorized SSH keys on the compromised instance.
- **Privilege Escalation:** Not applicable; the attacker leveraged the existing permissions of the AI agent to retrieve keys.
- **Defense Evasion:** Use of legitimate API keys to blend in with high-volume research traffic; targeting "vibe-coded" (low-security) experimental sites.
- **Credential Access:** Prompt injection/Direct social engineering of an AI agent to reveal environment variables/keys.
- **Discovery:** Monitoring Certificate Transparency logs for keywords related to LLMs and agents.
- **Lateral Movement:** Minimal; focused on credential harvesting for external use.
- **Collection:** Harvesting of model provider API keys.
- **Exfiltration:** Direct use of API credits from external attacker-controlled systems.
- **Impact:** Resource exhaustion (financial/credit theft).
## Impact Assessment
- **Financial:** $600,000 in AI credits (waived by the provider, but otherwise a total loss).
- **Data Breach:** Potential exposure of unpublished evaluation data via a SQL bug (though no evidence of attacker exploitation was found).
- **Operational:** Temporary shutdown of the public transcript viewer API.
- **Reputational:** Public disclosure required to maintain transparency in the AI safety community.
## Indicators of Compromise
- **Network indicators:** Unrecognized SSH connections to EC2 instances; high-volume API requests from non-METR IP addresses.
- **File indicators:** Unauthorized keys added to `authorized_keys`.
- **Behavioral indicators:** AI agents reporting their own system prompts or environment variables to users.
## Response Actions
- **Containment:** Revoked the compromised API key and removed unauthorized SSH keys.
- **Eradication:** Took the vulnerable SQL query mechanism offline.
- **Recovery:** Applied spend alerts and usage caps to all model provider accounts.
## Lessons Learned
- **Vibe-coding Risks:** Experimental or "vibe-coded" apps lack the rigorous security scaffolding (error handling, auth checks) required for public-facing deployments.
- **Monitoring Gaps:** High-volume research environments provide cover for "living off the land" style credit theft if granular spend alerts are not active.
- **Shadow IT:** Personal cloud instances used for research can become entry points if they contain organizational credentials.
## Recommendations
- **Automated Guardrails:** Implement hard spend limits and anomaly detection for all API keys.
- **Security Policy:** Prohibit the storage of organizational API keys on non-standard/personal cloud infrastructure.
- **Code Review:** Require security reviews for any internal tool (even "experimental" ones) that is placed behind a public URL.
- **Secret Management:** Use dedicated secret management services (e.g., AWS Secrets Manager) rather than exposing keys to agent prompts or environment variables.