METR reports $600,000 API-credit theft and database flaw exposing unpublished evaluations

METR disclosed that attackers stole an API key from a researcher’s personal EC2 instance and used it for weeks to consume model credits. The key belonged to METR’s general-access account for public models and was not authorized to access private models or hidden chain-of-thought data. In a separate incident, a public-facing database flaw exposed a read-only SQL query mechanism that could have reached unpublished evaluation data. The database was intended to hold only category 2 material, but some category 3 data had been included accidentally.

The stolen key was used to consume credits worth approximately $600,000, although the model provider had supplied them at no charge. No evidence was found that the attackers accessed private models, hidden chain-of-thought data, or nonpublic model credentials. The database flaw did not result in any confirmed data exposure, but an independent researcher responsibly disclosed the vulnerability. METR paid a bounty for the flaw and took the affected API offline.

METR said the delayed detection stemmed from a monitoring gap rather than a lack of traffic. Its usage dashboard did not show rate-limited requests for all users, and the account had no spending ceiling because METR was not paying for the tokens. That combination made unusual usage harder to distinguish from normal evaluation activity. Without spend alerts or tighter credential permissions, the compromise persisted for weeks.

In response, METR revoked the researcher’s access, stopped and imaged the EC2 instance, rotated credentials, and wiped the researcher’s laptop. It added monitoring, tightened network separation, increased logging, and reduced credential permissions. METR also hired additional security staff and commissioned further red-team testing. These steps aim to limit lateral movement, detect anomalous API use sooner, and enforce least-privilege access.