METR AI Research Firm Reports Two Major Security Incidents
AI Research Firm METR Discloses $600k API Key Theft
Impact Scope
Affected Companies
Industries Affected
Related Entities(initial)
Organizations
Full Report(when first published)
Executive Summary
METR (Model Evaluation and Threat Research), a non-profit focused on AI safety, has disclosed two significant security incidents that occurred earlier this year. The first, in March 2026, involved the theft of an API key that was subsequently used by a financially motivated actor to rack up approximately $600,000 in fraudulent charges for AI model inference. The second incident, in May 2026, was a sustained, automated attack campaign targeting METR's public infrastructure. While METR states no sensitive information was accessed, these events underscore the high value of AI resources and the increasing targeting of AI research organizations by threat actors.
Threat Overview
METR detailed two distinct attacks that highlight different threat vectors against AI organizations:
Incident 1 (March 2026): API Key Theft An attacker gained access to an API key used for inference on public AI models. This key was then abused to consume a massive amount of cloud computing resources, resulting in a financial loss of about $600,000. This type of attack, known as cryptojacking or resource hijacking, is purely financially motivated and exploits the high cost of AI computation.
Incident 2 (May 2026): Sustained Probing Campaign This was a more sophisticated, multi-faceted attack involving automated agents. The campaign included:
- Systematic scanning of METR's public infrastructure for vulnerabilities.
- Credential stuffing attacks against authentication providers.
- Attempts to abuse OAuth token grant mechanisms.
- Phishing campaigns targeting METR staff.
During this period, METR also discovered an unrelated, inadvertent exposure of a read-only SQL query mechanism that could have potentially leaked unpublished evaluation data.
Technical Analysis
The incidents demonstrate a range of TTPs targeting AI infrastructure:
- API Key Theft: The March incident centered on
T1528 - Steal Application Access Token. The key was likely exfiltrated from a misconfigured server, public code repository, or a compromised developer machine. - Automated Reconnaissance: The May attack heavily utilized techniques like
T1595 - Active Scanningto probe for weaknesses in real-time. - Credential Attacks: The attackers employed
T1110.003 - Password Sprayingor credential stuffing against login portals. - Social Engineering: The use of phishing against staff (
T1566 - Phishing) shows a blended approach, combining technical and human-targeted attacks.
Impact Assessment
- Financial Impact: The most direct impact was the $600,000 financial loss from the fraudulent API usage. This highlights the significant monetary risk associated with unsecured AI/ML cloud resources.
- Operational Disruption: Responding to these incidents required significant time and resources from METR's security and engineering teams, diverting them from their primary mission.
- Reputational Risk: Although METR reported that no sensitive data was lost, the incidents can damage the reputation of an organization focused on security and safety.
- Potential Data Exposure: The accidentally exposed SQL API, while not exploited by the attackers, represented a significant risk of leaking sensitive research data and model information.
Detection & Response
- Cloud Cost Monitoring: Implement billing alerts and cost anomaly detection in cloud environments. A sudden, massive spike in spending is a primary indicator of resource hijacking. This relates to D3FEND's Resource Access Pattern Analysis (D3-RAPA).
- API Key Monitoring: Use tools to scan code repositories and public assets for exposed credentials. Monitor API usage logs for anomalous activity, such as calls from unusual IP addresses or a sudden increase in request volume.
- Authentication Log Analysis: Monitor authentication logs for high rates of failed logins, which can indicate password spraying or credential stuffing attacks. This is a form of D3FEND's Authentication Event Thresholding (D3-ANET).
Mitigation
- Credential Management: Store all API keys, tokens, and secrets in a secure vault (e.g., HashiCorp Vault, AWS Secrets Manager). Never hardcode credentials in source code or configuration files.
- Least Privilege for API Keys: Create API keys with the minimum required permissions. Use short-lived tokens whenever possible and restrict key usage to specific IP address ranges.
- Multi-Factor Authentication (MFA): Enforce MFA on all user accounts, especially for developers and administrators, to protect against credential stuffing.
- Security Awareness Training: Train employees to recognize and report phishing attempts, a key component of MITRE mitigation
M1017 - User Training.
Timeline of Events
Article Updates
September 2, 2026
New details on METR's API key theft, including AI agent interaction and SSH persistence, clarify financial impact and highlight attacker use of AI agents.
Update Sources:
MITRE ATT&CK Mitigations
Credential Access Protection
Use secure vaults and secrets management systems to protect API keys and other credentials from theft.
Multi-factor Authentication
Enforce MFA on all accounts to mitigate the risk of credential stuffing and password-based attacks.
User Training
Train employees to identify and report phishing attempts targeting them and the organization.
Timeline of Events
An attacker steals a METR API key and begins consuming AI credits.
A sustained, automated attack campaign begins probing METR's public infrastructure.
Sources & References(when first published)
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.