INCIDENT EVIDENCE GRAPH
AI evaluation organization METR hacked; API key stolen for 20 days, consuming USD 600,000 in AI credits
#ArtificialIntelligence AI evaluation organization METR was hacked. Its API key was stolen for 20 days, resulting in USD 600,000 in AI charges. METR is the independent research organization responsible for investigating an OpenAI agent attack on HF. An employee used AI to build an application that contained a vulnerability, which led to the exposure of API credentials. The credentials were likely resold by hackers to downstream proxy services; otherwise, it would have been unlikely for USD 600,000 in usage to accumulate over 20 days. However, METR’s models are sponsored by AI companies, so the organization did not need to actually pay the bill. Read the full article: https://ourl.co/126593
- Victim: METR
- Actor: Hackers
- Exploit: Exposed API credentials
- Method: Hackers used stolen API credentials for 20 days, consuming AI API credits.