Attackers Stole METR API Key and Consumed AI Credits Worth About $600,000

METR disclosed two notable security incidents. In March 2026, attackers stole an API key used for inference on public models and consumed a substantial amount of API credits over three weeks. In May 2026, attackers systematically probed METR’s publicly accessible infrastructure and attempted to access internal data, but METR said there was no evidence that non-public data was accessed.