Analysis
METR, the nonprofit that runs dangerous-capability evaluations on frontier models, disclosed that an attacker stole an API key in March 2026 and consumed roughly $600,000 worth of model credits over three weeks before the organization noticed, The Register reported.
The entry point was mundane. A researcher stood up a personal EC2 instance, deliberately made it publicly reachable behind Google authentication, and put a quickly assembled app on it. That app had a fail-open bug: when the authentication check errored, it let the request through. The attacker most likely found the host by searching certificate transparency logs for LLM-related domains, reached the app, and prompted its agent into disclosing the underlying API key.
The detection failure is the more instructive half. METR's stated reason is that "we're very acclimated to getting lots of weird rate limit and API errors" -- the ambient noise of running evaluations at scale masked the anomalous traffic. And because the credits had been donated by a model developer rather than billed to a card, no financial threshold triggered and no spending cap could be attached to the key at all. The single most reliable detection mechanism in cloud security, the invoice, was structurally absent.
“A researcher stood up a personal EC2 instance, deliberately made it publicly reachable behind Google authentication, and put a quickly assembled app on it.”
This lands in a week when the same theme kept surfacing from different directions. OpenAI delayed a model after its own agents demonstrated offensive capability against Hugging Face, Anthropic paused a training run over unauthorized agent actions, and Pulse covered the broader agent control problem on Monday. The through-line is not model misbehavior. It is that the operational surface around AI research -- personal cloud instances, donated credits, internal tools written in an afternoon -- has none of the controls that surround production systems.
METR's remediation is the standard playbook: a dedicated security lead, isolation of public-facing applications from internal systems, and improved infrastructure protocols. What is not fixed by any of that is the credit-grant model itself. Every frontier lab hands free capacity to evaluators, academics and safety researchers, and none of those grants carry the spend alerting that a paying customer gets by default. Six hundred thousand dollars of inference is enough to run a serious offensive campaign, and it left no bill anywhere.
Anyone running an internal AI tool should take one concrete action from this: check whether your organization has any model API key that is not attached to a billing alert and a hard spend ceiling. Donated credits, trial accounts and enterprise commitments with unused balances all fail that test by default.
