AI and Tech Summaries - AI Weekly Malaysia

Summaries

Short AI and tech summaries with source links, signal scores, and why each update matters for builders, founders, and Malaysian tech workers.

Window

Today Yesterday This week Last week This month Last month All time

Showing 1-1 of 1 results

Date	Provider	Score	Summary
01 Sep 2026, 5:05 PM	The Hacker News	8.5	Attackers Steal METR API Key and Consume AI Credits Worth About $600,000 METR, a non-profit that evaluates frontier AI models for agentic tasks, disclosed two security incidents. In March 2026, attackers found a researcher's personal EC2 instance running a 'vibe-coded' agent orchestration dashboard via certificate transparency logs, exploited a fail-open auth vulnerability that silently disabled Google authentication, then prompted the agent directly to reveal its model provider API key—consuming approximately $600,000 in AI inference credits over three weeks. In May 2026, attackers separately probed METR's public infrastructure but failed to access internal data. Why: If you are vibe-coding or rapidly prototyping agent dashboards with LLM API keys, you need to assume attackers are actively scanning certificate transparency logs for sites with LLM/agent keywords and will prompt your exposed agent to dump its API key. Rotate and restrict API keys, never rely solely on Google auth without a fail-closed fallback, and set spending alerts on any inference account. The $600,000 bill was only absorbed because the provider gave credits for free—you would not be so lucky. security ai-agents api-keys vibe-coding incident-report fail-open-vulnerability

Date

Provider

Score

Summary

01 Sep 2026, 5:05 PM

The Hacker News

8.5

Attackers Steal METR API Key and Consume AI Credits Worth About $600,000

METR, a non-profit that evaluates frontier AI models for agentic tasks, disclosed two security incidents. In March 2026, attackers found a researcher's personal EC2 instance running a 'vibe-coded' agent orchestration dashboard via certificate transparency logs, exploited a fail-open auth vulnerability that silently disabled Google authentication, then prompted the agent directly to reveal its model provider API key—consuming approximately $600,000 in AI inference credits over three weeks. In May 2026, attackers separately probed METR's public infrastructure but failed to access internal data.

Why: If you are vibe-coding or rapidly prototyping agent dashboards with LLM API keys, you need to assume attackers are actively scanning certificate transparency logs for sites with LLM/agent keywords and will prompt your exposed agent to dump its API key. Rotate and restrict API keys, never rely solely on Google auth without a fail-closed fallback, and set spending alerts on any inference account. The $600,000 bill was only absorbed because the provider gave credits for free—you would not be so lucky.