How did the attacker find METR's exposed dashboard?

The attacker scanned certificate transparency logs for sites that looked LLM-related, which surfaced a researcher's agent orchestration dashboard running on a personal EC2 instance. The instance sat behind Google authentication, but a fail-open bug meant the check let requests through. The attacker then asked the agent directly to reveal its model provider API key.

Why did $600,000 of usage not trigger an alert?

METR routinely runs evaluations that consume enormous numbers of tokens, so heavy use did not look unusual. The credits had been granted free by the model developer, so no billing threshold fired, and that class of key had no spend limit at the time. The jump in usage went unnoticed for several days, then continued for three weeks.

What happened in the second incident?

In May 2026, attackers systematically probed METR's infrastructure looking for a way to reach frontier models. Separately, METR found that a SQL query mechanism unintentionally exposed in its public transcript viewer carried a bug that allowed access to unpublished evaluation data.

What has METR changed since the incidents?

METR added spend alerts to API keys, formalised a security review before anything is deployed publicly, and clarified its policy on holding credentials outside METR infrastructure. It also hired a security lead and plans more security staff, retired legacy infrastructure, ran threat-modelling reviews, expanded logging, and cut alert noise so real signals stand out.

METR · 2026-08-31 · major

METR discloses two breaches — $600K of model credits burned unnoticed

METR, the group that measures how capable frontier models are, published a security report on August 31. An attacker took an API key from a researcher's exposed dashboard and spent about $600,000 of credits over three weeks.

METR

METR published a postmortem on two 2026 breaches, including an API key theft that burned $600,000 of model credits.

Quick facts

Organization	METR
Published	August 31, 2026
Incidents	Two — March 2026 and May 2026
Credits used	About $600,000
Time undetected	Three weeks
Entry point	A researcher's EC2 dashboard with a fail-open auth bug
Changes made	Spend alerts, security review process, new security lead

What is it?

METR's security update, posted August 31, 2026, describes two separate intrusions. In March an attacker stole a model provider API key and used roughly $600,000 of credits before anyone noticed. In May, attackers probed METR's infrastructure, and a bug in its public transcript viewer exposed unpublished evaluation data.

How does it work?

The March break-in started with a researcher's own EC2 instance running an agent orchestration dashboard. It was meant to sit behind Google authentication, but a fail-open bug disabled that check. The attacker located the host by scanning certificate transparency logs for LLM-related names, prompted the running agent to print its provider API key, and added SSH keys to keep access.

Why does it matter?

METR is the organisation labs rely on to measure dangerous model capabilities, which makes its own credentials and unpublished evaluation transcripts a real target. The detection gap is the lesson worth copying: free credits meant no billing alarm, and an evaluation lab's normal traffic is already huge, so three weeks of theft blended in. Spend limits on every key and a review before anything faces the internet are the cheap fixes.

Who is it for?

teams running agents and holding model provider keys

Frequently asked questions

How did the attacker find METR's exposed dashboard?: The attacker scanned certificate transparency logs for sites that looked LLM-related, which surfaced a researcher's agent orchestration dashboard running on a personal EC2 instance. The instance sat behind Google authentication, but a fail-open bug meant the check let requests through. The attacker then asked the agent directly to reveal its model provider API key.
Why did $600,000 of usage not trigger an alert?: METR routinely runs evaluations that consume enormous numbers of tokens, so heavy use did not look unusual. The credits had been granted free by the model developer, so no billing threshold fired, and that class of key had no spend limit at the time. The jump in usage went unnoticed for several days, then continued for three weeks.
What happened in the second incident?: In May 2026, attackers systematically probed METR's infrastructure looking for a way to reach frontier models. Separately, METR found that a SQL query mechanism unintentionally exposed in its public transcript viewer carried a bug that allowed access to unpublished evaluation data.
What has METR changed since the incidents?: METR added spend alerts to API keys, formalised a security review before anything is deployed publicly, and clarified its policy on holding credentials outside METR infrastructure. It also hired a security lead and plans more security staff, retired legacy infrastructure, ran threat-modelling reviews, expanded logging, and cut alert noise so real signals stand out.