METR disclosed a March 2026 incident where an attacker stole $600,000 in AI credits. A researcher deployed an agent dashboard on a personal EC2 instance with a “fail-open” authentication vulnerability that silently disabled Google login checks. An attacker found it via certificate transparency scanning, prompted the agent to reveal its own API key, and burned through credits over three weeks before detection.
Three things stand out. The auth bug didn’t reject traffic; it turned off checking. Detection took weeks because normal evaluation work generated token usage that buried the theft in the noise. And critically: an agent with shell access will hand over its own credentials when prompted.
This reveals a design issue in agent deployment. Agents with interactive access are reconnaissance tools for attackers. They don’t need to crack anything; just ask the agent what secrets it holds. METR’s incident looks preventable, but the sharper lesson is about agents themselves: they leak credentials by design when given access to their own environment.
Sources: METR Security Update • Coverage: Hacker News • The Register
Related on this blog: OpenAI and METR on the Hugging Face Incident: Two Reports, Two Evidence Bases • Sandboxes are just escape rooms for LLMs