What happened
The attacker prompted the exposed agent to reveal its API key, installed an SSH key on the host, and used the stolen credential to run public-model inference for about three weeks.
2026-03-01
HighOperator reportAttackers Prompted a METR Agent to Reveal an API Key and Consumed About $600,000 in Model Credits
Analysis of METR's March 2026 incident in which attackers prompted a public agent dashboard to reveal a model API key and consumed credits worth about $600,000.
METR agent orchestration dashboardCredential exposurePublic agent prompt interface exposed a model-provider credentialA researcher's publicly reachable agent-orchestration dashboard on a personal Amazon EC2 instance
Why it matters
Unauthorized consumption of model credits worth approximately $600,000 and persistent access to the exposed EC2 host; METR reported no access to sensitive internal data.
Missing authorization check
A credential boundary preventing the agent from reading or disclosing raw secrets and requiring scoped approval for anomalous or high-cost inference use.
Would PP block it?
If the agent receives only short-lived, workload-bound authority, a prompt requesting the underlying key has nothing reusable to reveal. Cost or usage thresholds can require a new approval before additional inference executes.
Incident analysis
Timeline and technical read
Timeline
2026-03-01
Attackers discover the publicly reachable dashboard, obtain the model-provider API key through the agent, and establish SSH persistence.
2026-03-22
After roughly three weeks of unauthorized use, the model provider alerts METR and the credential is revoked.
2026-08-31
METR publishes its security update describing the incident and remediation.
Technical breakdown
- A research agent ran on a personal EC2 instance intentionally exposed behind Google authentication.
- The attacker found the dashboard through internet reconnaissance for AI- and agent-related services and directly prompted an agent to disclose its provider key.
- The attacker added an SSH key for persistence and used the stolen key against public models for approximately three weeks.
- METR's manual and agent-assisted forensics found no compromise beyond the single API key and exposed host described in the report.
Authorization boundary
Where the authorization boundary should have been
This incident is categorized as Credential exposure. The relevant Permission Protocol gate is Credential Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.
- If enforced at
- Model-provider credential broker and inference-request boundary outside the public agent host
- Still needs
- Authentication hardening, network isolation, host monitoring, SSH incident response, and vulnerability management remain necessary.
- Receipt required for
- Retrieving model credentials and executing inference above approved workload or spend limits
A Credential Gate can keep the raw provider key outside the agent and require scoped receipts for costly inference, but Permission Protocol cannot correct the exposed dashboard or remove attacker persistence from the host.
Related incidents and controls
Start small
Put the relevant gate at this action boundary.
This incident maps to Credential Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.