METR reports $600K in stolen AI credits

METR says attackers consumed roughly $600,000 in inference credits over three weeks after stealing an API key, although the model provider had granted those credits for free, according to METR’s security incident disclosure. The evaluator says no sensitive data was accessed in either of two incidents and says it has since added public-environment isolation, broader logging, unusual-usage monitoring, and spend alerts. Builders should file the near-miss beside the ten-minute exploit window observed after a public patch clue: free model credits still need hard ceilings and credentials must stay out of public workloads.