METR Got Hacked Twice and Didn't Notice One of Them for Three Weeks
METR, the nonprofit behind some of the more serious AI model evaluation work, has admitted to two security incidents earlier this year. One involved a stolen API key that someone quietly milked for three weeks. The other was a sustained probing campaign that came uncomfortably close to exposing sensitive model data. Neither ended in catastrophe, but neither reflects particularly well on an organisation whose entire purpose is assessing risk.
The first incident, back in March, started with a researcher running AI agents on a personal EC2 instance that was deliberately left open to the internet, protected only by Google authentication. The instance happened to contain an API key for METR's public models account. A "vibe-coded" app on the instance had a fail-open authentication bug, which essentially rolled out the welcome mat to anyone who stumbled across it.
And someone did stumble across it. METR believes the attacker was trawling certificate transparency logs for freshly registered sites with LLM-flavoured keywords, essentially hunting for hastily built apps likely to have credentials lying around. They found one. They prompted the agent running on the instance into handing over its API key, then added an SSH key for persistent access. Then spent three weeks quietly burning through around $600,000 worth of inference credits.
Three weeks. Nobody noticed.
METR addresses this directly, which is to their credit. The organisation runs heavy evaluations constantly, so unusual API errors and high token usage are just background noise. More critically, the credits had been given to METR for free by the model provider, so no invoice arrived to raise any flags. There was also no spending cap on that type of key at the time. So the attacker had free run of a generous credit pool with nothing to trigger an alarm.
The second incident hit in May. METR was tipped off that financially motivated attackers were trying to get illicit access to frontier models, and watched as those attackers methodically worked through its public-facing infrastructure. The toolkit was thorough: automated vulnerability scanning, credential stuffing, OAuth token grant attempts, phishing, and AI agents being used to automate the whole process.
At the same time, METR had accidentally exposed a read-only SQL query interface through its public transcript viewer. A bug in the scoping meant queries could reach unpublished evaluation data, and some sensitive model information had ended up in the same database. Whether the attackers found this particular hole is unknown, but METR says there's no evidence they did. An independent security researcher found it independently and reported it responsibly. They got a bounty. The endpoint got taken offline.
METR's response to all of this has been fairly standard: tightened infrastructure, new protocols, a freshly hired security lead, and promises of further investment in the function. Public-facing systems are now isolated from internal infrastructure.
The honest disclosure is welcome. Security incidents happen, and organisations that actually document what went wrong are more useful to the broader community than those that bury it. Still, there's a certain irony in a team that researches AI risk spending three weeks oblivious to an active intrusion on their own systems.