METR API Key Compromised, Resulting in ~$600,000 in Unauthorized AI Credit Usage
A significant security incident has come to light involving the theft of an API key from METR, an organization focused on AI evaluation and benchmarking. According to reports, attackers successfully exfiltrated the credential and used it to access AI platform services, ultimately consuming approximately $600,000 worth of computational credits.
The incident highlights the ongoing challenges organizations face in securing their cloud-based API credentials. API keys serve as critical authentication tokens for accessing AI services and platforms, and their exposure can lead to rapid, substantial financial losses as threat actors can programmatically leverage these services at scale.
Security experts advise organizations to implement robust API key management practices, including:
- Regular key rotation to limit exposure windows
- Least-privilege access principles to restrict what compromised keys can access
- Monitoring and alerting systems to detect unusual API consumption patterns
- Secure storage solutions such as secret management services rather than environment variables or hardcoded values
This case serves as a reminder of the financial risks associated with credential theft in AI infrastructure, where computational resources can be consumed rapidly and at significant cost once access is obtained.