Attackers Steal METR API Key and Consume AI Credits Worth About $600,000

METR, a non-profit AI research group, suffered two cyberattacks in 2026, including theft of an API key that led to unauthorized use of AI credits worth about $600,000. The breaches exploited a vulnerability in a publicly accessible agent dashboard but no sensitive data was accessed.