METR lost $600,000 of AI credits to one stolen key. The attacker got it by asking the agent.
Every documented theft of somebody else’s inference so far has taken the key from a file. This one asked a running agent to hand it over, and it did.
By Parminder Kumar Sharma · · 8 min read
What METR actually disclosed
METR published Update on Security at METR on 31 August 2026, covering two incidents from earlier in the year. It opens by ruling out the reading most people would reach for: "this post focuses on incidents where external actors attempted to gain unauthorized access to METR’s systems, not AI agents hacking in our evaluations." This is not an agent escaping. It is an agent being robbed.
The March incident runs as follows. A researcher with no sensitive access ran agents on a personal EC2 instance, deliberately made public behind Google authentication. That instance held an API key for METR’s general-access account, scoped to public models only. Then, in METR’s words, "the vibe-coded app included a fail-open vulnerability that silently disabled authentication, which led to the system being exposed to the public internet for several days."
The new way to steal an API key is to ask for it
The step that has not been seen before
Every documented route into somebody else’s inference so far has been a conventional credential theft. A key committed to a public repository. An infostealer on a laptop. A config file on an exposed share. This one is different, and the sentence is worth reading twice:
The credential was not found. It was disclosed, on request, by a running agent. No secret scanner addresses that. Nor does key rotation, nor pre-commit hooks, nor any of the tooling built over the last decade to stop keys leaking into places they should not be. Those all assume the key sits in a file somewhere. Here it sat in an agent’s reachable context, and the agent was helpful.
How the instance was found at all is METR’s own inference, and they hedge it properly: "we suspect that the attacker found the instance by looking through recently-registered websites (e.g. in certificate transparency lists) to find vibe-coded sites with high-signal keywords relating to LLMs or agents, for purposes of harvesting potentially exposed model provider API keys." Treat that as a hypothesis, not forensics. If it is right, the reconnaissance is trivially cheap and entirely passive.
The $600,000 is not a bill, and that matters
METR’s sentence is precise: "These credits would have been worth approximately $600,000, although the model developer had granted them to METR for free."
So METR was never invoiced. What it lost was donated research compute. The words refund, absorb and reimburse appear nowhere in the disclosure, because there was nothing to refund.
This is being reported the other way round. The Hacker News writes that the credits "would have racked up approximately $600,000 in bills", which is a defensible paraphrase that nonetheless inverts the point. Having no bill is not a footnote to the story. It is the reason nobody noticed for three weeks.
Why three weeks of theft produced no alert
| What should have caught it | Why it did not |
|---|---|
| A cost spike on the invoice | The credits had been granted free, so in METR’s words there was ‘no natural token spend ceiling’. |
| A per-key spending limit | METR: ‘as of the incident there was no way to put a spending limit on keys like this one’. |
| Rate-limit errors | A lab running large evaluations is ‘very acclimated to getting lots of weird rate limit and API errors’, most of them spurious. |
| The internal usage dashboard | It ‘didn’t show data on rate-limited requests to all users, even if they were occurring’. |
METR found it themselves in the end, by noticing that a large increase in model usage did not correspond to any evaluation they were running.
The provider controls would not have helped either
METR’s claim that no per-key spending limit existed is worth testing against what the major providers actually document, because it generalises well beyond METR.
Spend controls at the two most likely providers, as documented today
| Control | Anthropic | OpenAI |
|---|---|---|
| Scope | Organisation and workspace, not per key | Organisation and project, not per key |
| Enforcement | Hard: HTTP 429 until the first of the next month | Default is an alert only; a hard cap is opt-in |
| Ceiling | Tiered ($500 / $1,000 / $200,000 per month), but Custom tier has no cap at all | Set per project, no default ceiling |
| Default key permission | Scoped to workspace | ‘All’ is the default setting |
A grant-funded nonprofit running large evaluations sits precisely where these controls stop working: on a bespoke arrangement with no monthly ceiling, spending credits it was given rather than money it is billed for. A $600,000 run over three weeks trips nothing, by design rather than by oversight.
This is a category now, not an incident
$46,000
per day, 2024
Sysdig’s original LLMjacking case, 6 May 2024. A follow-up in September put a Claude 3 Opus case near $100,000 a day.
~$1m
in one case
Unit 42’s Token Jacking research, 6 August 2026, on charges accrued before discovery and containment.
1,275,105
AI secrets leaked
AI service secrets added to public GitHub commits in 2025, up 81% year on year (GitGuardian, 17 March 2026).
64%
still valid
Of secrets leaked in 2022 and still active and exploitable (GitGuardian, same report).
The day before METR published, BleepingComputer reported that Anthropic had begun signing users out after infostealers hijacked Claude sessions to consume their usage, wiping saved payment methods and refunding unauthorised charges. Vidar, LummaC2, StealC, RedLine and Acreed on Windows, AMOS on Mac.
So within eight days: an agent talked into disclosing a key, commodity infostealers harvesting live sessions, and a ransomware operator running an AI coding agent from his own laptop. The common thread is not any one technique. It is that AI credentials have become worth stealing on their own account, independent of whatever else is on the machine.
What is not in the disclosure
METR is unusually candid, and it is still worth marking the gaps.
What to do about it
Take this with you
For anyone whose team runs agents outside production
- Assume any credential reachable by an agent is disclosable. Not stealable, disclosable. If the agent can read it, a sufficiently direct prompt can retrieve it, and no secret scanner will tell you that happened.
- Stop putting production or shared credentials on personal infrastructure. METR’s first policy change after this was exactly that, and the researcher involved had no sensitive access to begin with.
- Treat free credits as a monitoring blind spot, not a saving. Granted or trial credits remove the one signal most organisations actually watch, which is the invoice.
- Set spend alerts on every key that supports them, and know which of yours do not. On both major providers, limits are organisation or project scoped, so a single stolen key inherits the whole ceiling.
- Audit what your internal usage dashboard does not show. METR’s did not surface rate-limited requests, which is where the evidence was sitting the whole time.
- Treat a fail-open authentication path as a public deployment. Auth that silently disables itself is worse than no auth, because you believe it is there.
The position
The uncomfortable part of this story is not the money, which was donated and which METR never had to find. It is that the exposure class is new and the entire defensive stack around secrets does not address it.
We have spent ten years building tooling on one assumption: that a credential is a string in a file, and the job is to stop that file reaching somewhere it should not. Scanners, pre-commit hooks, rotation policies and vaults all inherit that assumption. An agent that holds a key in its context and answers questions about it breaks the assumption rather than defeating the tooling.
METR caught this, investigated it properly, hired a security lead and published a candid account naming its own fail-open bug. That is considerably more than most organisations would do about compute nobody was billed for. The rest of us should take the free lesson.
