METR (Model Evaluation and Threat Research), a nonprofit that evaluates frontier AI models for dangerous capability thresholds, disclosed two security incidents this year in which attackers attempted unauthorized access to its systems. In the first, which occurred in March 2026, a researcher built a “vibe-coded” agent orchestration dashboard on a personal EC2 instance that was meant to be protected by Google authentication. A bug in the app silently disabled that authentication — leaving the dashboard exposed to the public internet for several days. Attackers, who METR believes were scanning recently registered websites for high-signal AI-related keywords to find exposed API keys, found the instance, prompted an agent to reveal its API credentials, then added their own SSH key for persistent access. Over the following three weeks they used the stolen key to consume a massive amount of inference credits on publicly available AI models. Had METR been paying market rates, the bill would have been approximately $600,000; the credits had been provided for free by the model provider, whose identity METR did not disclose.
The second incident, observed in May 2026, was a broader and more sophisticated attack campaign by a likely financially motivated threat actor. The attackers used AI agents themselves to systematically probe METR’s public-facing infrastructure — credential-stuffing authentication providers, attempting OAuth token grants, scanning newly deployed services, and attempting to phish staff. Around the same time, METR discovered it had inadvertently exposed a read-only SQL query interface in its public transcript viewer; although the endpoint was scoped to public data by design, a bug caused it to also include sensitive model evaluation data that was never meant to be accessible. An independent security researcher discovered and reported the issue before the attackers could exploit it. METR said it has since updated policies prohibiting METR credentials from being placed on non-METR infrastructure, improved monitoring, and added spend caps on API keys.