AI Safety Watchdog METR Lost $600,000 in Computing Credits After a Stolen Key Went Unnoticed for Three Weeks
Two separate security incidents hit the nonprofit that vets the world's most powerful AI models. One exposed a secret access key. The other could have leaked unpublished research that major AI companies share in confidence.
Key points
- METR, a nonprofit that tests AI models for safety risks on behalf of OpenAI, Google, Anthropic and others, disclosed two separate security incidents on 31 August 2025.
- In March 2025, a stolen API key (a secret digital password that lets software talk to a service) allowed an attacker to run up roughly $600,000 in computing charges over three weeks.
- In May 2025, attackers probed a publicly accessible part of METR's systems and came close to reaching unpublished evaluation data, including sensitive results from private AI models.
- An independent researcher found the May vulnerability first and reported it responsibly; METR paid a bounty reward and took the affected service offline.
- METR says it has no evidence that any private model data was actually taken in either incident.
METR (Model Evaluation and Threat Research) is a small nonprofit with an outsized role. Major AI companies, including OpenAI, Anthropic, Google, Meta and Amazon, hand it their most sensitive models to probe for dangerous capabilities before public release. What METR learns stays confidential. That makes its security posture matter far beyond its own walls.
The organisation disclosed both incidents, first reported by Dark Reading, in a single blog post on 31 August.
How did the first breach happen?
A METR researcher, working on a personal cloud computer rather than company equipment, built an AI agent tool using a practice sometimes called "vibe-coding," meaning writing software quickly with AI assistance rather than formal engineering discipline. The tool had a flaw: it silently switched off its own login checks, leaving the system open to anyone on the internet for several days.
Attackers appear to have found it by scanning newly created vibe-coded websites for exposed API keys. An API key is a secret string of characters that acts like a password, letting one piece of software bill charges to a company account. Once the attacker found the key, they also planted an SSH key (a separate credential that opens a back door into a server) to keep access even if the original flaw was fixed.
For roughly three weeks, the attacker quietly used METR's account to run AI model queries, racking up approximately $600,000 in charges on publicly available models. METR eventually revoked the key, rotated credentials and tightened rules about putting company secrets onto personal devices.
What happened in May?
By May, METR was facing a sustained wave of probing from a separate group, apparently seeking financial gain or access to advanced AI research. The attackers used automated tools to try combinations of stolen usernames and passwords (called credential stuffing), sent phishing emails designed to trick staff into handing over login details, and scanned for newly launched services.
During this campaign, METR accidentally left a read-only database query tool visible on the public internet through its transcript viewer, a tool that displays logs of AI model conversations. A chain of two bugs together could have let an outsider pull unpublished evaluation results, including some data from private, not-yet-released AI models.
An independent security researcher spotted the flaw and reported it to METR before any data left the building. METR took the endpoint offline, paid a bounty and found no evidence the attackers had actually discovered or used the exploit.
Should ordinary people be worried?
Directly, no. METR holds research data, not consumer records. No names, payment details or medical information appear to have been at risk.
The broader concern is structural. METR sits inside the supply chain of every major Western AI lab. If an organisation at this level of maturity gets caught by a misconfigured personal laptop and an accidentally exposed database query tool, it signals how much basic security hygiene still varies across the AI industry.
Jacob Krell, senior director of secure AI solutions at Suzu Labs, put it plainly: "If an organization at that maturity level is getting caught by basic cloud and credential hygiene issues, it tells you about the floor of AI industry security, not the ceiling."
What has METR done since?
| Area | Action taken |
|---|---|
| Staffing | Hired a dedicated security lead, with more hires planned |
| Infrastructure | Shut down older systems that unnecessarily expanded exposure |
| Credentials | Increased rotation frequency, narrowed permission scopes |
| Monitoring | Added logging and alerts for unusual API key use |
| Network | Strengthened separation between public-facing and internal systems |
| Testing | Commissioned additional third-party security reviews |
METR did not respond to a request for comment.
Common questions
Does this affect the AI models I use every day?
No evidence suggests any consumer-facing AI product was altered or that private model data reached the wrong hands. The incidents touched METR's own infrastructure, not the models it evaluated.
Why does a nonprofit evaluator hold such sensitive data?
AI companies submit unreleased models to METR for independent safety checks before launch. That process requires sharing confidential results, which is why METR's security matters to the whole AI industry, not just to METR itself.
