Attackers Steal METR API Key and Consume AI Credits Worth About $600,000

METR, a research non-profit, experienced two significant security incidents where attackers attempted to gain unauthorized access to its systems. The incidents resulted in the theft of a METR API key, which was then used to consume AI credits worth approximately $600,000. No sensitive information is believed to have been compromised during the incidents. METR evaluates artificial intelligence models for their ability to perform complex tasks. The organization, also known as Model Evaluation and Threat Research, was targeted by external actors. The security incidents did not appear to involve the loss of sensitive information.