Attackers Steal METR API Key and Consume AI Credits Worth About $600,000

Summary

METR experienced two security incidents: an API key theft leading to $600,000 in consumed AI credits and a probing of infrastructure. No sensitive data was accessed, and METR has updated security measures.

Key Takeaways

1. METR disclosed two security incidents where external actors attempted unauthorized access to its systems.
2. In March 2026, attackers stole an API key for inference on public models and consumed a substantial amount of credits.
3. No sensitive information is believed to have been accessed as a result of these incidents.

Statement Breakdown

• Claimed Facts: 60% of statements the article presents as facts
• Opinions: 30% of statements classified as editorial or subjective
• Claims: 10% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article presents factual information about security incidents at METR, citing the organization's own disclosures. While it avoids sensationalism, the lack of attribution for the attackers and the reliance on METR's internal reporting slightly temper its overall credibility.

Bias assessment: Technical Reporting. The article focuses on the technical details of security breaches and their impact. It presents information objectively, without adopting a particular political or social stance, and prioritizes factual reporting of the events.

Note: This article provides details on security incidents. While factual, consider cross-referencing with other sources for a broader perspective on the implications.

Credibility flag: Informative, but verify

Claimed Facts (6)

• This sentence provides factual background and the core disclosure of the article.
• This statement presents a factual claim about the outcome of the incidents.
• This is a factual statement about the current understanding of the attackers.
• This is a direct quote detailing a specific event that occurred.
• This is a direct quote describing the second security incident.
• This statement quantifies the financial value of the consumed credits.

Opinions (5)

• The term 'vibe-coded app' and the description of the vulnerability's effect are interpretive and subjective, even if based on technical findings.
• The use of 'suspect' and 'likely' indicates an inference or hypothesis rather than a definitively proven fact.
• The description 'sustained external attack campaign' and 'likely financially motivated' are interpretations of the observed activity.
• The phrase 'could have been exploited' indicates a potential rather than a confirmed exploitation.
• The word 'accidentally' implies intent or lack thereof, which is an interpretation of the situation.

Claims (1)

• This statement asserts a negative (no indication of discovery or access), which is difficult to definitively prove and relies on the completeness of the evidence presented to METR.

Key Sources

• METR — Research non-profit
• Ravie Lakshmanan — Author
• The Hacker News — Media Outlet