AI research non-profit METR has disclosed two security incidents – and while no sensitive information is believed to have been accessed, one of the attacks led to what might have been a massive bill.
According to METR, attackers stole an API key for inference on public AI models in March, consuming $600,000 worth of credits. Luckily, the model developer had granted them to METR for free.
A researcher used agents running on a personal EC2 instance intentionally made publicly accessible behind Google authentication and containing an API key for METR’s general-access (public models) account.
METR noted that the vibe-coded app included a fail-open vulnerability that silently disabled authentication, exposing the system to the public internet for several days.
METR reckons the attacker found the instance by looking through recently registered websites to find vibe-coded sites with high-signal keywords relating to LLMs or agents.
The attacker prompted an agent directly to reveal its model provider API key, added an SSH key for persistent access, and over the course of three weeks used the stolen credentials to consume the API credits.
Why didn't METR notice?
METR noted that because the organisation is “accustomed to running evaluations and experiments that use large volumes of tokens”, the incident flew under the radar.
The non-profit regularly runs large-scale evaluations with pre-deployment AI models, meaning it typically deals with “lots of weird rate limits and API errors”.
"At the time of the incident, our internal usage dashboard didn’t show data on rate-limited requests to all users, even if they were occurring,” METR said.
Notably, because it wasn't actually paying for the tokens there was no natural token spend ceiling, and no way at the time to put a spending limit on keys.
METR lifts lid on separate attack
In another attack in May, METR spotted attackers systematically probing its publicly accessible infrastructure, including an unsuccessful attempt to access internal data via an inadvertently exposed endpoint.
"We were tipped off that we were being targeted by hackers who appeared to be financially motivated and may have been looking to obtain frontier model access," it said.
"We observed the attackers systematically probing our publicly accessible infrastructure, with heavy use of agents to automate vulnerability discovery, including by credential stuffing authentication providers, attempting OAuth token grants, scanning newly deployed services, and attempting to phish staff."
METR said it's now maintaining an isolated public production environment for public-facing applications that's architecturally separated from its internal infrastructure.
This means a misconfiguration in a public service can't expose internal data. It's also hired a security lead and is expanding security staff further.
Elsewhere, METR revealed it has shut down legacy infrastructure that was unnecessarily expanding the attack surface and has set up monitoring for unusual API key usage and other abnormal behavior.
"Although these incidents had limited consequences, we considered them near-misses, and increased our security investment in response," it said.
FOLLOW US ON SOCIAL MEDIA
Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.
You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.
Multi-cloud with AWS and Azure just got a whole lot easier thanks to a new interconnect service
Cato Networks launches SMB FlexPool to help MSPs scale managed SASE services
