The agent handed over its API key, and the logs looked normal
Attackers prompted a METR agent into revealing its API key, then spent about $600,000 in model credits over three weeks inside normal-looking evaluation traffic.
Credential theft has a standard mental image: a phishing page, a leaked .env file, an infostealer on a laptop. In the incident METR disclosed this week, the attacker needed none of that. They found an exposed agent dashboard and asked the agent for its API key. The agent answered.
The facts, per METR’s own write-up. In March 2026, a researcher ran agents on a personal EC2 instance, with the orchestration dashboard placed behind Google authentication. A fail-open bug — METR’s words: authentication was “silently disabled” — left the dashboard open to the internet for several days. METR believes the attackers found it by scanning certificate-transparency lists for newly registered sites with LLM and agent keywords. Once in, they prompted an agent to reveal the API key for METR’s general-access model account, and added an SSH key for persistence. Over roughly three weeks they consumed model credits that would have billed at about $600,000 — credits the model developer had granted METR for free, and ultimately absorbed. Trade coverage confirms the disclosure also describes a second, unrelated wave of probing in May: credential stuffing, OAuth token-grant attempts, and phishing against staff, none of which METR found evidence succeeded.
METR is a security-conscious research organization that published a candid postmortem, and nothing here is unique to them. The incident earns this space because it stacks three failures — each general, each likely present somewhere in your estate — along the identity, approval, and audit axes.
An agent is a credential holder you can socially engineer
The key was not in a dotfile the attacker had to find. It was held by a process whose entire job is to answer requests, and one of the requests was for the key. This is OWASP’s LLM02, sensitive information disclosure, in its plainest form: whatever an agent can read, an agent can be talked into repeating.
Treat that as an identity statement, not a prompt-engineering one. An agent with a credential in its environment is a non-human identity with a conversational interface — it can be socially engineered like an employee, but it takes no training, harbors no suspicion, and files no report afterward. And the blast radius was set long before the prompt: this was a key to an organization-level account, not a token scoped to one agent, one task, one time window. One question exfiltrated the spending power of the whole account.
Fail-open authentication fails without a record
There was an identity control in front of the dashboard. It degraded silently — no error, no alert, no log entry announcing that the gate was now open. An authentication layer that fails open is worse than absent, because everyone continues to behave as if it is there. For several days the only party who knew the true state of the perimeter was the attacker.
The discovery path deserves attention too. Certificate transparency exists so that TLS issuance is publicly auditable; it also means every new deployment is announced to anyone watching. A dashboard on personal infrastructure that never crossed a deployment-approval gate was still, within days, discoverable by strangers. METR’s remediations — a formal security review for public-facing deployments, explicit policy on credentials outside METR infrastructure — read as an acknowledgment that the approval step, not the researcher, was the missing control.
Three weeks invisible, not for lack of logs
The usage was recorded the entire time. It went unnoticed for three weeks because, per METR, their own evaluation runs routinely generate enormous token volumes, their internal dashboard did not surface the relevant request data, and the credits were free — so no invoice ever arrived to ask the question money usually asks.
That last point generalizes further than it first appears. For most API keys, billing is the accidental audit system: the one report a human reliably reads. Remove the price signal — free credits, flat-rate contracts, internal chargeback nobody reviews — and detection falls entirely on attribution: the ability to say which workload, which job, which owner this usage belongs to. A single shared account key cannot answer that, so the abuse did not have to hide. It landed inside the baseline and matched it. Logs that cannot tie consumption to an identity are volume counters, not evidence.
What we’d check this week
None of this requires METR’s stack — only an honest inventory.
- List every place an agent or automation holds a long-lived credential it can read at runtime. Assume each one can be prompted, coerced, or bugged into disclosing it, and ask what that key can spend or reach.
- Test your authentication middleware’s failure mode in staging: break its dependency and observe whether the app closes or opens. If it can fail open without an alert, it already may have.
- Take your highest-volume API key and answer three questions: which workload, which owner, what is normal daily usage? If several workloads share it, abuse will hide inside your own baseline exactly as it did here.
- Check whether keys with no billing signal — free tiers, promotional credits, flat-rate plans — have usage alerts. Where money is silent, something else must not be.
- Watch certificate transparency for your own domains. It shows you what attackers see, including the deployments that never passed review.
Sources
- Security update — METR’s first-party incident disclosure
- LLM02:2025 Sensitive Information Disclosure — OWASP GenAI risk entry covering credential disclosure through model output
- Attackers Steal METR API Key and Consume AI Credits Worth About $600,000 — The Hacker News, secondary coverage
- AI Model Evaluator METR Hit by Credential Theft, Probing — Dark Reading, secondary coverage
Axowl builds identity and audit infrastructure where every credential is bound to a named workload and its usage is attributable by construction — so consumption that belongs to no one has nowhere to blend in. How it works.