Attacker asked a researcher's personal 'vibe-coded' agent dashboard for the model provider's API key

Fail-open is a precise bug shape. A request arrives, and the application tries to establish who is calling. The check errors, or returns nothing, and the handler reads the empty answer as authorisation rather than as a failure. METR says the protection on the instance was Google authentication, and that the application's own flaw silently disabled it ^[5].

What made the bypass expensive is what the application was for. An agent-orchestration dashboard is an instruction channel into a process that already holds provider credentials and tool access, so whoever gets past the door does not need a file-read primitive. METR says the attacker prompted an agent to reveal the model provider's API key, installed an SSH key to keep its foothold, and used the credential for roughly three weeks ^[7].

That three-week span matters more than it might seem. The stolen credential was a general-access key rather than one for private models ^[8], so its traffic looked like ordinary public API usage. METR also says its internal dashboard did not surface every rate-limited request to users, and that unusually heavy usage and provider errors were routine during large evaluation runs ^[10]. An evaluation harness hammering a provider looks, in aggregate, a lot like a stranger hammering the same provider on your key.

Now the arithmetic. About $600,000 of list value ^[2] over roughly three weeks, call it 21 days ^[7], runs near $28,600 a day ^[1]. Whether that rate means anything in your shop depends on whether your key sits on an account billed at list. METR's sat on capacity a model developer had donated, so no invoice ever arrived to argue with ^[3].

The exposure window and the credential lifetime also came apart. The dashboard was publicly reachable for several days ^[4] while the key kept working for about three weeks ^[7], which puts most of the consumption after the app itself stopped being the way in ^[2].

Segmentation, though, is the part that held. METR's mission requires privileged access to unreleased models, hidden chain-of-thought outputs and confidential laboratory information ^[15], and the researcher who stood up the experiment had access to none of that ^[5]. A boundary drawn before the incident is why the loss was denominated in public-model tokens.

The remediation reads accordingly: security reviews formalised for public applications, use of METR credentials and data on personal infrastructure restricted, usage monitoring expanded, and spending alerts added where providers support them ^[14].

Hosting location alone would not have caught the other opening. METR had inadvertently exposed a read-only SQL mechanism through its own public transcript viewer, meant to be limited to public information, where a bug could have allowed access to unpublished evaluation data, and some sensitive model outputs had been placed in that database by mistake ^[19]. An independent security researcher found it and reported it, and METR removed the API and paid a bounty ^[20].

The control I would want out of this is per-application keys with their own spending ceiling, including on free capacity, because the ceiling is the only part of a credential you can set before you know who ends up holding it.