METR API Key Theft Consumes $600,000 in AI Credits

Model Evaluation and Threat Research (METR), a non-profit that evaluates frontier artificial intelligence models for long-horizon tasks, disclosed two notable security incidents where external actors attempted unauthorized access to its systems. No sensitive information is believed to have been compromised. ¹

The stolen key allowed attackers to consume approximately $600,000 worth of AI credits—largely cloud computing costs from providers such as AWS or Azure. ¹

They use OpenAI’s GPT‑3 and GPT‑4 APIs, which charge based on token usage. Similar attacks have targeted academic research groups running large language models because these organizations typically lack robust security infrastructure designed to protect sensitive credentials.

This incident underscores threat actors target evaluation platforms to gain insight into vulnerabilities across many deployed systems, highlighting the need for stronger security measures around API keys in AI research environments. ¹