## AI Safety Non-Profit METR Targeted in Two Sophisticated Cyberattacks **METR**, a research non-profit dedicated to evaluating frontier artificial intelligence (AI) models, has revealed it was the target of two distinct security incidents. External actors attempted to gain unauthorized access to **METR**'s systems, with one incident leading to the theft of an API key and substantial credit consumption. Despite the attempts, **METR** believes no sensitive information was accessed. The organization shared its findings with partner AI companies before public disclosure. The attacks have not been attributed to specific threat actors, nor did they involve AI agents breaking out of evaluations. "In March 2026, attackers stole an API key for inference on public models and consumed a substantial amount of credits," **METR** stated. "In May 2026, we observed attackers systematically probing our publicly accessible infrastructure, including an unsuccessful attempt to access internal data via an inadvertently exposed endpoint." ### The March Incident: Stolen API Key and Credit Abuse The first incident in March 2026 involved a **METR** researcher using agents on a personal **EC2** instance, intentionally made publicly accessible behind **Google** authentication. This instance, however, contained an API key for **METR**'s general-access public models account. A "vibe-coded app" on the instance suffered from a "fail-open vulnerability" that silently disabled authentication. This exposed the agent orchestration dashboard to the public internet for several days. **METR**'s analysis suggests the attacker likely discovered the instance by scanning recently registered websites (e.g., in certificate transparency lists) for sites with high-signal keywords related to **LLMs** or agents. The goal was to harvest potentially exposed model provider API keys. Upon identifying the system, the threat actor directly prompted an agent to reveal its model provider API key, added an **SSH** key for persistent access, and used the stolen credentials. This led to the consumption of a significant amount of API credits on publicly available models over a three-week period. The illicit usage, if billed, would have amounted to approximately $600,000. Fortunately, the credits were provided to **METR** for free by the model provider, which was not named. The large-scale nature of **METR**'s evaluations and the absence of token spend caps meant the unauthorized usage was not immediately detected. Following the incident, **METR** has updated its security policies regarding the placement of credentials or data on non-**METR** infrastructure, enhanced monitoring, and implemented spend alerts where possible. ### The May Incident: Sustained Probing and Exposed Endpoint The second attack in May 2026 was a "sustained external attack campaign," likely orchestrated by a financially motivated threat actor targeting unlawful access to frontier AI models. **METR** observed attackers systematically probing its publicly accessible infrastructure. This campaign heavily utilized agents to automate vulnerability discovery, including credential stuffing authentication providers, attempting **OAuth** token grants, scanning newly deployed services, and attempting to phish staff. During this period, **METR** inadvertently exposed a read-only **SQL** query mechanism built into its public transcript viewer. While queries were scoped to public data by default, a bug could have allowed access to unpublished evaluation data. Furthermore, the database accidentally included sensitive model data, despite being intended for non-sensitive models. **METR** became aware of this exposure only after an independent security researcher discovered and reported it, leading to the API being taken offline. "The attackers had probed this endpoint in passing as part of their broader campaign, but the evidence shows no indication that they discovered the exploit or accessed any non-public data," **METR** confirmed.