The non-profit AI auditing organization METR disclosed two of its own security incidents from March and May 2026 on August 31, 2026. In the more consequential of the two, attackers obtained an access key through a poorly secured internal application and, unnoticed, consumed credits worth approximately $600,000 over three weeks.
Misconfigured Test Application Opens Access to Access Key
According to METR, the starting point was an agent orchestration application that an employee operated on a private Amazon EC2 instance – actually secured by a Google login. However, a programming error silently disabled this protection and opened the system to the entire internet for several days. The attacker likely found the instance by searching certificate transparency logs for newly registered sites with conspicuous AI agent terms.
Subsequently, he directly prompted the running agent to disclose its own access key for the language model, additionally set up an SSH access for permanent access, and used the stolen data to consume credits on publicly accessible models for three weeks. The resulting value of approximately $600,000 – quantified by METR itself and not independently verified – was derived from the market price of the consumed computing power, not from a real invoice, as the model provider had made the quota available for free. Because METR was already generating large amounts of model queries as part of its testing series, the unusual load initially went unnoticed; the internal dashboard also did not display every throttled request from individual users, and there was no spending limit for the affected key. After internal auditors noticed the abuse, METR isolated the affected instance, secured an image for forensic evaluation, replaced all affected access credentials, and had the responsible employee’s computer reinstalled. The security service provider Calif subsequently confirmed the results of the internal investigation.
Second Attack Targets Unpublished Test Protocols
In May 2026, METR registered a second wave of attacks, which it assessed as financially motivated, against the publicly accessible infrastructure of the organization. The attackers used AI agents to systematically search for vulnerabilities: they tried stolen access credentials in large numbers, attempted to trick OAuth grants, scanned newly deployed services, and contacted employees via phishing emails.
In the process, they discovered a read-only query interface in METR’s public transcript viewer, a tool through which test protocols can be viewed. A software bug could theoretically have also allowed access to unpublished evaluation data, including individual sensitive model outputs. However, an independent security researcher found the vulnerability first, reported it to METR, and received a bounty for it. According to the organization, there is no evidence that the attackers found or exploited the vulnerability themselves. As a precaution, METR temporarily took nearly all publicly accessible services offline during the investigation before creating a specially isolated production environment for public applications, separate from the internal infrastructure. METR assigns internal data four confidentiality levels; the two most sensitive categories remained untouched in both incidents according to its own review.
Incident Joins Growing Series of Stolen AI Accesses
The case joins a growing series of incidents where stolen access credentials to AI services are at the center – such as the attack on the open-source gateway LiteLLM affecting more than 2500 companies. The security company CrowdStrike had also recently warned about targeted hijacking of corporate accesses to AI services. Just in July, METR itself called for independent audits of AI agents after the breach of OpenAI agents at Hugging Face. External reports, such as from The Hacker News, primarily rely on METR’s own account, stating that no particularly sensitive data was accessed in either of the current incidents. There is currently no attribution to a known attacker group; METR only describes the attackers of the second incident as presumably financially motivated, without providing further details.
As a structural consequence, METR has reportedly created a dedicated security position, expanded collaboration with Calif for ongoing security audits, and introduced regular threat analyses. Access keys are to receive shorter lifetimes and tighter permissions in the future, and the organization has also enhanced its logging and equipped servers with additional protective software.
The crux of the matter lies in the fact that an organization warning other companies about the risky behavior of their AI agents became vulnerable due to a simple misconfiguration of a self-built internal application. It remains to be seen whether METR can still identify the attackers or if both cases will remain unresolved as before.
