Executive Summary
METR disclosed two security incidents in which attackers stole an API key and consumed about $600,000 in AI credits.
What Happened
METR (short for Model Evaluation and Threat Research and pronounced "Meter"), a research non-profit that evaluates frontier artificial intelligence (AI) models for their ability to carry out long-horizon, agentic tasks, disclosed that it suffered "two notable security incidents" where external actors attempted to gain unauthorized access to its systems. No sensitive information is believed to
Affected Products
- METR
Vulnerability / Attack Technique
Stolen AI API key abuse
Technical Mechanism
A stolen key was used to run up model usage.
AI Security Category
LLM10:2025 Unbounded Consumption
Relevant Frameworks
RealGround Analysis
AI keys are directly monetizable. RealGround analysis: spend caps would have limited the loss.
Recommended Controls
- Set spend limits and alerts on AI API keys
- Rotate keys regularly
Related RealGround Service
AI Agent SBOM and LLM Mapping · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/09/attackers-steal-metr-api-key-and.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.