METR, a non-profit organization evaluating frontier AI models, disclosed August 31 that attackers exploited two separate security incidents to steal API keys and consume approximately $600,000 in AI credits provided free by model providers. The breaches occurred in March and May and expose critical vulnerabilities in AI research infrastructure, including fail-open authentication flaws and reconnaissance via certificate transparency logs.
March Incident: Fail-Open Authentication and Prompt Injection Enable API Key Theft
The first compromise targeted a researcher’s EC2 instance running agent orchestration. An attacker exploited a fail-open vulnerability in Google authentication protecting the dashboard, which was inadvertently exposed to the internet.
The attacker discovered the instance by searching certificate transparency lists for keywords related to LLMs and agents, then prompted an agent to reveal its API key. After obtaining the credential, the attacker added an SSH key to establish persistent access to the compromised environment.
The prompt injection technique — where an attacker provides input that causes an AI agent to execute unintended commands — represents a distinct attack vector from traditional system exploitation. In this case, the agent was designed to process queries and execute tasks, but lacked safeguards to prevent it from disclosing its own credentials when directly prompted. The combination of the exposed dashboard and the agent’s failure to restrict sensitive information disclosure created a complete compromise path that required no traditional exploitation techniques.
How Certificate Transparency Logs Enabled Reconnaissance
Certificate transparency logs, designed to detect rogue SSL certificates, provide a public record of domain and subdomain certificates. In this case, METR’s exposed EC2 instance appeared in CT logs with agent- and LLM-related keywords, allowing the attacker to identify the research environment as a high-value target without traditional network scanning. The attacker then leveraged the fail-open authentication flaw — a configuration where authentication failures default to granting access — to reach the agent orchestration dashboard.
May Incident: Sustained Infrastructure Probing and SQL Query Exploit
The second incident involved a sustained external attack campaign that included systematic infrastructure probing, credential stuffing, OAuth token grant attempts, and phishing targeting METR staff.
METR’s public transcript viewer contained an exposed SQL query mechanism with a bug that could access unpublished evaluation data. The organization stated that evidence shows no indication the attackers discovered the exploit or accessed any non-public data, though the vulnerability’s presence during an active targeting campaign signals the scope of the broader reconnaissance effort.
SSH Backdoor and $600K Credit Consumption Across Both Incidents
Across the two incidents, attackers consumed approximately $600,000 in AI credits. The March breach resulted in an SSH backdoor that provided ongoing access until discovered. METR updated security policies, improved monitoring, and added spend alerts to API keys in response, but made no mention of credit recovery from providers.
The dual breaches illustrate how AI research infrastructure faces attack vectors distinct from traditional cloud environments: prompt injection attacks that extract credentials directly from agents, fail-open authentication defaults in rapid prototype environments, and reconnaissance via certificate transparency metadata that links infrastructure to specific research domains.
METR’s role as a frontier AI model evaluator means the organization holds access to unreleased models and evaluation datasets that represent significant intellectual property for model providers. The $600,000 in consumed credits is a direct financial impact, but the potential exposure of unpublished evaluation data or model access represents a broader risk to the AI research ecosystem. While METR stated that evidence shows no indication attackers accessed non-public evaluation data through the SQL query exploit, the sustained May campaign’s combination of credential stuffing, OAuth attempts, and phishing suggests a coordinated effort to gain persistent access rather than opportunistic credit theft.
Organizations building AI agent systems must implement guardrails that prevent agents from disclosing sensitive information when prompted. The METR incident demonstrates that traditional authentication and network security controls are insufficient when the agents themselves can be directly manipulated to reveal credentials. Spend alerts and improved monitoring address detection but do not prevent the initial compromise when an agent can be tricked into exposing its own API key.
