Research Non-Profit METR Discloses Major Security Breach After Hackers Drain $600,000 in AI Credits

How the Attack Unfolded and What Was Accessed

METR, a non-profit focused on evaluating advanced AI systems, revealed it experienced two significant security incidents earlier this year. The organization, known for assessing how AI models handle complex, long-term tasks, confirmed that attackers stole an API key and used it to consume roughly $600,000 worth of AI computing credits. The breach was disclosed in a public statement on September 1, 2026.

The stolen API key granted unauthorized access to METR’s computational resources, allowing the attackers to run extensive AI workloads over an unspecified period. These resources are typically used by METR to test frontier AI models for safety and performance. The organization did not specify which AI provider’s services were affected or whether any sensitive research data was compromised. However, it emphasized that no core research findings or internal systems were directly breached. METR has since revoked the compromised key and implemented additional monitoring protocols.

Could This Have Been Prevented?

According to METR’s disclosure, the attackers likely obtained the API key through indirect means, possibly via a compromised third-party service or misconfigured access point. Once in possession of the key, they were able to authenticate as if they were legitimate users, bypassing standard access controls. The scale of credit consumption suggests the attackers ran large-scale or prolonged AI operations, potentially including model training or inference tasks. METR estimates the financial impact at approximately $600,000, though the exact duration of unauthorized usage remains under investigation. The non-profit has not ruled out the possibility of further vulnerabilities being exploited during the incident window.

Cybersecurity experts note that API key theft is a common vector for cloud-based attacks, especially when keys are stored insecurely or lack expiration policies. METR’s incident highlights the risks faced by research organizations that rely heavily on external AI platforms for testing. In response, the non-profit has begun rotating all active API keys and enhancing its credential management framework. It is also working with its AI service providers to strengthen authentication mechanisms and improve anomaly detection. While METR has not identified any direct harm to its research integrity, the breach underscores growing threats to AI-focused institutions.

What is METR and why was it targeted? METR is a non-profit that evaluates advanced AI models for safety and capability. Attackers likely targeted it to gain access to expensive AI computing resources without paying for them.

Frequently Asked Questions

How much damage did the breach cause? The attackers consumed approximately $600,000 worth of AI credits using a stolen API key. No sensitive research data was reported as compromised.

What steps is METR taking to prevent future breaches? METR has revoked the compromised key, rotated all active credentials, and is improving monitoring and authentication processes to detect similar threats early.