METR (Machine Learning Evaluation Research team), a security-focused nonprofit, suffered a credential theft incident in which threat actors gained access to an API key. The stolen key was used to consume approximately $600,000 worth of public AI model credits. The organization has since rotated credentials and is reviewing access controls to prevent recurrence.

Which products are affected?

Cloud-based AI model evaluation infrastructure (unspecified provider)

What should defenders do?

Rotate all exposed API keys and secrets immediately. Implement secret management solutions (e.g., vaults) to avoid hardcoded credentials. Enforce strict access controls and least-privilege principles for AI service accounts. Monitor API usage for anomalous consumption patterns. Review and rotate credentials following any suspected compromise.

highPrivacy

METR AI Model Evaluator Compromised via Credential Theft Resulting in $600,000 in Unauthorized AI Credit Consumption

Security nonprofit's API key stolen; threat actors exploited cloud-based AI services, prompting urgent access control review

CyberIntel DeskPublished 24 days agoUpdated less than a minute ago1 min read

METR AI Model Evaluator Compromised via Credential Theft Resulting in $600,000 in Unauthorized AI Credit Consumption

Key Takeaways

METR, a security-focused AI evaluation nonprofit, experienced a credential theft incident involving an API key.
Threat actors used the stolen key to consume approximately $600,000 in public AI model credits.
The attack vector and threat actor identity have not been publicly disclosed.

Related Security News

highData Breaches

Times Car Confirms Data Breach Affecting 6.6 Million User Accounts

Times Car, a Japanese car-sharing service, has confirmed a data breach compromising approximately 6.6 million user accounts. The incident was disclosed late last week, with the exact attack vector and nature of exposed personal information yet to be fully specified. Authorities and the company are reportedly investigating the breach.

BleepingComputerabout 4 hours ago1 min read

highdata-breaches

French Tax Administration Data Breach Exposed Hundreds of Thousands of Records via Stolen Staff Credentials

An unauthorized access incident at France's Direction Générale des Finances Publiques (DGPP) compromised tax data belonging to hundreds of thousands of taxpayers and businesses between June and July 2026. According to a report published by France's national cybersecurity agency ANSSI on 29 September 2026, the attacker used stolen staff passwords to gain entry. The agency stated the attack was 'not sophisticated' and went undetected for seven weeks due to weak security controls. ANSSI noted that neither the tax administration nor the agency itself observed data exfiltration, though the breach resulted in unauthorized access to sensitive fiscal information.

The Hacker Newsabout 5 hours ago1 min read