Attackers Steal METR API Key and Consume AI Credits Worth About $600,000

METR (short for Model Evaluation and Threat Research and pronounced "Meter"), a research non-profit that evaluates frontier artificial intelligence (AI) models for their ability to carry out long-horizon, agentic tasks, disclosed that it suffered "two notable security incidents" where external actors attempted to gain unauthorized access to its systems. No sensitive information is believed to

Reported facts: METR, a nonprofit that evaluates frontier AI models, disclosed two security incidents in which external actors stole a METR API key and used it to consume roughly $600,000 worth of AI compute credits; METR believes no sensitive information was accessed, but the incidents exposed weaknesses in its access controls and monitoring around AI infrastructure. RealGround analysis: This reflects an AI supply chain and infrastructure security issue where stolen credentials to AI evaluation or deployment environments can lead to large-scale resource abuse and potential lateral movement into more sensitive systems. Organizations relying on third‑party AI platforms or evaluation stacks should harden API key management, enforce least‑privilege access, and proactively monitor for anomalous AI resource usage to detect and contain similar abuse.