AI Safety Firm METR Discloses $600K Credential Theft via Exposed Agent Infrastructure

An authentication bypass in publicly exposed infrastructure led to the theft of an API key and $600,000 in model credits at METR, an AI safety research nonprofit. The incident, which occurred over a three-week period in March 2026 but remained undetected until late August, highlights systemic vulnerabilities in how AI model credits are monitored and protected.