METR, a cybersecurity nonprofit that evaluates AI model safety and capabilities, suffered a credential theft attack resulting in the unauthorized consumption of $600,000 in public AI model credits.
The attack centered on the theft of an API key that granted attackers access to METR's cloud infrastructure. Threat actors leveraged the stolen credential to spin up compute-intensive AI inference jobs, rapidly exhausting the organization's prepaid credits across multiple AI platforms. The organization detected the unauthorized activity and immediately revoked the compromised key, halting further resource depletion.
METR operates in a sensitive segment of AI security. The nonprofit conducts evaluations of large language models and other AI systems to identify capabilities that could pose risks if deployed irresponsibly or exploited maliciously. This work informs safety decisions at major AI companies and regulatory bodies. The credential theft underscores how attackers can target even security-focused organizations, particularly those working with valuable cloud resources.
The scale of the attack reveals both the speed at which cloud resources can be consumed and the financial impact of insufficient API key management. At typical cloud pricing rates for AI inference services, $600,000 represents substantial compute access. Attackers executed the breach with apparent efficiency, suggesting either prior knowledge of METR's infrastructure or automated scanning for exposed credentials.
METR's investigation into the breach remains ongoing. The organization has not publicly disclosed the specific threat actor behind the attack or whether other data was accessed during the intrusion. Initial findings indicate the API key was the primary attack vector, though investigators are examining how the credential became exposed in the first place. Common scenarios include accidental commits to public code repositories, exposure in log files, or compromise of developer machines.
The incident reflects broader vulnerabilities in cloud security posture across organizations handling sensitive work. API keys represent critical secrets that provide direct access to infrastructure and services. Unlike passwords, they often lack interactive verification and remain valid until explicitly revoked. Organizations frequently struggle with key rotation, segregation of privileges, and detection of unauthorized use.
For nonprofits and research organizations with limited security budgets, the exposure is particularly acute. METR's work depends on partnerships with AI companies that grant API access and credits for evaluation purposes. Defenders must balance open collaboration with researchers against the risk of credential compromise.
This attack carries implications for organizations evaluating AI safety. Threat actors recognize that disrupting AI safety research serves their interests, whether through direct theft of credentials, data exfiltration, or denial of service via resource exhaustion. Organizations in this space should implement API key management solutions that enforce rotation policies, monitor for unusual usage patterns, and segment access by function and environment.
METR responded appropriately by revoking the compromised key immediately upon detection. The organization recommends that other research entities and technology companies implement continuous monitoring of API usage, establish alerts for anomalous compute consumption patterns, and maintain offline backups of API keys for critical infrastructure. The incident reinforces that credential theft remains one of the fastest paths to infrastructure abuse in cloud environments.