Sometimes, to steal expensive resources, it is enough simply to ask the AI to give a secret. The non-profit organization for the assessment of models and threat analysis METR revealed an incident in which the stolen API key in three weeks allowed to spend loans for public models worth about $600 thousand.
The attack began in March 2026 with a personal instance of Amazon EC2, where a METR employee launched agents. The server was deliberately opened from the Internet and configured Google authentication, but the application created by vibe-coding contained a failure-open error. In case of internal failure, the mechanism discreetly disabled the identity check, so the control panel remained available to outsiders for several days.
METR suggests that the attacker searched for newly registered sites through certificate transparency logs and selected addresses with words related to large language models and agents. After discovering the panel, the attacker asked the agent to reveal the model provider's API key, and then added his own SSH key to save access to the server.
The stolen credentials only opened public models and did not provide access to private development or confidential information. The amount of $600 thousand also did not become a direct financial loss of METR. The model developer provided loans free of charge, but their uncontrolled flow rate showed how long the stolen key could go unnoticed without limits and individual warnings.
The abnormal flow rate was lost among the usual load. METR regularly conducts large trials and is accustomed to high volumes of tokens, speed limits and unusual API errors. The internal panel showed not all requests rejected due to exceeding the limits, and the free key did not have a ceiling. It was only three weeks later that the surge was linked to foreign activity.
After detecting the compromise, METR withdrew the employee’s access, stopped and copied the server for analysis, replaced the credentials on it and cleared the work computer. The check did not reveal other stolen keys or access to sensitive information. The organization also ordered the public deployment of applications to be agreed upon and prohibited to keep official secrets on personal infrastructure.
In May, METR was confronted with a separate campaign, whose participants scanned external services, checked stolen passwords, tried to get OAuth tokens and sent phishing messages to employees. There were no signs of internal data theft. To reduce risk, the organization has divided public and internal infrastructure, reduced the life of keys, narrowed access rights and included alerts for abnormal resource expenditure.
The attack began in March 2026 with a personal instance of Amazon EC2, where a METR employee launched agents. The server was deliberately opened from the Internet and configured Google authentication, but the application created by vibe-coding contained a failure-open error. In case of internal failure, the mechanism discreetly disabled the identity check, so the control panel remained available to outsiders for several days.
METR suggests that the attacker searched for newly registered sites through certificate transparency logs and selected addresses with words related to large language models and agents. After discovering the panel, the attacker asked the agent to reveal the model provider's API key, and then added his own SSH key to save access to the server.
The stolen credentials only opened public models and did not provide access to private development or confidential information. The amount of $600 thousand also did not become a direct financial loss of METR. The model developer provided loans free of charge, but their uncontrolled flow rate showed how long the stolen key could go unnoticed without limits and individual warnings.
The abnormal flow rate was lost among the usual load. METR regularly conducts large trials and is accustomed to high volumes of tokens, speed limits and unusual API errors. The internal panel showed not all requests rejected due to exceeding the limits, and the free key did not have a ceiling. It was only three weeks later that the surge was linked to foreign activity.
After detecting the compromise, METR withdrew the employee’s access, stopped and copied the server for analysis, replaced the credentials on it and cleared the work computer. The check did not reveal other stolen keys or access to sensitive information. The organization also ordered the public deployment of applications to be agreed upon and prohibited to keep official secrets on personal infrastructure.
In May, METR was confronted with a separate campaign, whose participants scanned external services, checked stolen passwords, tried to get OAuth tokens and sent phishing messages to employees. There were no signs of internal data theft. To reduce risk, the organization has divided public and internal infrastructure, reduced the life of keys, narrowed access rights and included alerts for abnormal resource expenditure.
