METR discloses API-key theft and attempted access to evaluation data

AI safety nonprofit METR disclosed two security incidents involving attempts to access its systems. In March, attackers obtained an API key from a publicly accessible personal EC2 instance after a fail-open authentication flaw exposed an agent dashboard; METR said the credentials were used for three weeks and would have incurred about $600,000 in inference credits. In May, attackers probed public infrastructure while an exposed read-only SQL mechanism could have allowed access to unpublished evaluation data. METR said it found no indication that non-public data was accessed.