METR Discloses $600,000 API Credit Theft and Agent-Led Attack Campaign

AI model testing nonprofit METR has disclosed two significant security breaches that occurred in early 2026. The incidents underscore the vulnerability of security-sensitive research environments to basic configuration errors and automated attack campaigns.

In March 2026, an attacker stole an API key from a researcher's personal EC2 instance. According to METR, the instance was left publicly accessible due to a "fail-open" bug in a "vibe-coded app." Over a three-week period, the attacker consumed approximately $600,000 in credits. METR noted that it did not ultimately pay for the usage because the unnamed model provider had granted the credits to the nonprofit for free.

Following this, METR faced a second security challenge in May. This incident involved a sustained attack campaign that utilized automated agents to conduct phishing, credential stuffing, and vulnerability discovery. During this period, a bug in METR's public transcript viewer exposed a read-only SQL query mechanism. While this flaw could have potentially leaked unpublished evaluation data, METR stated there is no evidence that attackers successfully exploited the vulnerability.

The Danger of Vibe-Coding

These lapses are particularly notable given METR's role as a Model Evaluation and Threat Research organization. The nonprofit recently collaborated with OpenAI to investigate how AI agents could be used to hack platforms like Hugging Face, making its own internal security failures a point of industry scrutiny.

The March breach highlights the specific danger of "vibe-coding"—a trend of rapid, informal development that prioritizes speed and intuition over rigorous security protocols. In this instance, the lack of formal security auditing for a researcher's personal instance created a direct path for the theft of high-value credentials.

Masking Illicit Usage

Beyond the technical flaw, the incident reveals a systemic risk in AI research: the difficulty of detecting theft in high-volume environments. Because METR's researchers were already acclimated to high token consumption and frequent API errors during their legitimate testing, the $600,000 theft went unnoticed for weeks. This suggests that the very nature of AI safety testing—which requires massive scale—can inadvertently mask the signals of a breach.

Future Outlook

METR is now updating its security processes to prevent similar occurrences. The industry is watching to see if other research organizations are similarly exposed by the "vibe-coding" culture or if the ability of AI agents to automate vulnerability discovery will lead to a surge in similar infrastructure attacks. For now, the primary lesson remains the critical need for strict credential management, regardless of whether the underlying credits are provided for free.