Threat
Update on Security at METR
Publication date not yet evaluated · Added · 3 reports metr.org
Page published
Coverage timeline
Why it matters
METR's stolen inference API key shows how AI model credentials can be abused for costly credit consumption and persistence, a growing attack surface for any organization exposing LLM API keys.
METR (Model Evaluation and Threat Research), a nonprofit that evaluates frontier AI models, disclosed two 2026 security incidents: in March attackers stole an API key used for inference on public models, established persistence, and consumed roughly $600,000 in AI model credits over several weeks; in May attackers probed public infrastructure and tried unsuccessfully to reach internal data via an inadvertently exposed endpoint. METR said no sensitive model-access or business data was accessed and increased its security investment in response.