METR, a nonprofit that evaluates frontier artificial intelligence models for their capacity to perform long-term autonomous tasks, disclosed it experienced two significant security breaches where outside attackers tried to gain unauthorized entry to its systems. The organization said no sensitive information appears to have been accessed during either incident. The attacks haven't been linked to any identified threat actor or group, and they didn't involve AI agents penetrating METR's evaluation systems.
The first breach occurred in March 2026 when attackers obtained an API key for inference on public models and burned through credits that would have cost roughly $600,000 if the nonprofit had been paying for them, according to METR. One of the organization's researchers—who had no access to sensitive materials—had been running agents on a personal EC2 instance that was deliberately made publicly reachable behind Google authentication. The instance held an API key for METR's general-access account. However, what METR called a "vibe-coded app" had a fail-open vulnerability that quietly turned off authentication, leaving the agent orchestration dashboard visible to anyone on the internet for several days. The threat actor prompted an agent directly to disclose its model provider API key, installed an SSH key to maintain persistent access, and then spent three weeks consuming a massive volume of API credits on publicly available models. METR said the unauthorized usage wasn't immediately detected because the organization regularly runs large-scale evaluations and experiments that burn through high token volumes, and there were no limits on token spending. The second incident happened in May 2026 when METR observed attackers methodically scanning its publicly accessible infrastructure, making heavy use of agents to automate vulnerability hunting—including credential stuffing authentication providers, trying OAuth token grants, scanning newly deployed services, and attempting to phish staff. At the same time, the research group accidentally exposed a read-only SQL query mechanism built into its public transcript viewer. While queries were restricted to public data by default, a bug in the component could have been exploited to reach unpublished evaluation data, and the database mistakenly contained sensitive model data even though it was supposed to hold only data from non-sensitive models.
METR explained that from its analysis, it suspects the attacker in the March breach discovered the instance by searching through recently registered websites—for example, in certificate transparency lists—to locate vibe-coded sites with high-signal keywords related to large language models or agents, with the goal of harvesting potentially exposed model provider API keys. The organization learned about the May SQL query vulnerability only after an independent security researcher found and reported it, prompting METR to take the API offline. The research group noted that the attackers had scanned this endpoint in passing as part of their wider campaign, but the evidence shows no sign they discovered the exploit or accessed any non-public data.
Following the March incident, METR said it has revised its security policies governing the placement of METR credentials or data on non-METR infrastructure or devices, enhanced monitoring, and added spend alerts to keys where feasible. The May breach has been characterized as a sustained external attack campaign likely driven by financial motives to obtain illegal access to frontier AI models. METR shared a version of its findings with AI companies it partners with before making the incidents public. The breaches highlight how even organizations dedicated to evaluating AI security can become targets themselves, particularly as the value of frontier model access grows and attackers increasingly use automated agents to hunt for exposed credentials. For AI research groups and model developers, the incidents underscore the tension between maintaining public-facing infrastructure for transparency and collaboration while defending against adversaries who deploy the very automation tools being studied.