METR Research Non-Profit Suffers Security Incidents Involving API Key Theft and Unauthorized Access

METR (Model Evaluation and Threat Research), pronounced 'Meter,' announced via its official channels that it suffered two separate security incidents involving unauthorized external access. In the incidents, attackers successfully obtained an API key and used it to consume AI credits worth approximately $600,000. METR emphasized that no sensitive information, including frontier model data or research findings, is believed to have been compromised or exfiltrated. The organization is treating the events as significant operational security incidents given the financial and reputational impact, though the full scope of what, if any, data was accessed remains under investigation. METR has not attributed the attacks to a specific threat actor or nation-state, and no malware or ransomware payloads were reported in connection with the breaches.