In one attack, threat actors stole an API key that ultimately led to the consumption of $600,000 in public AI model credits for the security nonprofit.

Attackers stole a METR API key and consumed credits worth about $600,000, while a later campaign failed to access internal data.

The model provider gave METR the credits for free. An actual customer would not have been so lucky