Agent credential disclosure incident
METR · research agent
- What happened
- METR disclosed that an attacker reached one of its agent dashboards, which was exposed to the internet, and prompted an agent to reveal its model-provider API key. The attacker then used the key for three weeks, consuming credits with a nominal value of about $600,000 (reported).
- Impact
- METR said the credits had been granted free of charge and that its investigation found no access to sensitive information.
- What would have caught it
- Keep provider keys out of anything an agent can reveal, and require login for dashboards. Alert on unusual key usage and spend.
- Sources
- METR security update (source date 2026-08-31)
- IT Pro (source date 2026-09-02)