GoKawiilA security nonprofit that helps evaluate risks in frontier AI models disclosed two cybersecurity incidents this week, including a breach that exposed an API key and a separate vulnerability that could have exposed nonpublic evaluation data.
METR (Model Evaluation and Threat Research) disclosed two security incidents on Aug. 31 in which it was targeted by cyberattackers. In March of this year, attackers stole an API key used for inference on public models and consumed what METR described in a blog post as a "substantial" number of credits. In May, the company saw attackers probe publicly accessible infrastructure, including "an unsuccessful attempt to access internal data via an inadvertently exposed endpoint."
Although METR described both incidents as "near misses," the March event involved a successful compromise in which an attacker used the API key to establish persistence on a system, and used the stolen credentials for weeks. In any case, METR said it increased its security investment in response.
Related:Cyera's Oasis Security Buy Is All About AI Agent Control
Some of these broader investments include hiring a security lead (with further security expansion to come), shutting down legacy infrastructure that expanded its attack surface, conducting regular threat modeling reviews, increasing logging coverage, and monitoring for unusual API key usage. It also deployed additional endpoint and server security software, increased credential rotation, and reduced "various permission scopes."
Two METR Incidents: March and May
Both disclosed incidents involve company data, which METR categorizes into four separate buckets.
METR classifies company data into four categories: category 1 covers previously published information; category 2 includes unpublished evaluation results involving public models and API keys granting access to public models; category 3 includes sensitive model access, such as private-model evaluation results, hidden chain-of-thought data, and API keys granting access to non-public models; and category 4 covers highly sensitive information, including intellectual property and business data.
For the March incident, a researcher with no access to category 3 or 4 data deployed agents to a personal AWS instance using an agent orchestration tool. The AWS EC2 instance included an API key for METR's public models account. The orchestration tool, which was vibe-coded, "included a fail-open vulnerability that silently disabled authentication, which led to the system being exposed to the public internet for several days."
Based on an analysis, METR suspects the attacker found the instance by looking through recently registered vibe-coded websites to harvest potentially exposed model provider API keys. An attacker found the system, prompted an agent to reveal the model provider API key, added an SSH key for persistence, and spent three weeks using these stolen credentials to consume approximately $600,000 in API credits on publicly available AI models.
... continue reading