Attacker stole a METR API key, used $600K worth of credits, and no one noticed for weeks
- ID
- 20479
- Status
- summarized
- Published
- 02 Sep 2026, 4:45 AM
- Fetched
- 02 Sep 2026, 7:24 AM
- Provider
- The Register
- Category
- technology
- Original URL
- https://www.theregister.com/security/2026/09/01/attacker-stole-a-metr-api-key-used-600k-worth-of-credits-and-no-one-noticed-for-weeks/5293730
- Source URL
- https://www.theregister.com/headlines.atom
Summary
- Score
- 8.5
- Created
- 02 Sep 2026, 7:28 AM
- Tags
- Audience
- developersvibe_codersai_agent_userssaas_founders
What happened
METR disclosed that in March 2026, an attacker found a researcher's publicly accessible EC2 instance running a 'vibe-coded app' with a fail-open auth bug, prompted an agent to reveal its API key, and spent three weeks consuming ~$600K in model credits. The attacker likely discovered the instance by scanning certificate transparency lists for recently-registered sites with LLM/agent-related keywords. METR also disclosed a May 2026 incident involving systematic probing of its public infrastructure.
Why it matters
If you are vibe-coding or rapidly prototyping AI agent apps on public cloud instances, attackers are actively scanning certificate transparency logs for sites with LLM/agent keywords to harvest exposed API keys. You need to ensure your auth doesn't fail-open, never let agents handle raw API keys in prompt-accessible contexts, and set hard spending alerts on your model provider accounts — METR's $600K went unnoticed for three weeks.
Discussion angle
The attack chain is brutally simple: cert transparency scanning → find vibe-coded site → prompt the agent to dump its API key → SSH persistence → slow credit drain. What guardrails should be default for anyone shipping agent apps on public infrastructure?