Attackers stole a METR API key and used it for three weeks, consuming… — The Hacker News

The Hacker News@thehackernews · 162.2K subscribers Open in TelegramOpen

🚨 Attackers stole a METR API key and used it for three weeks, consuming credits worth about $600,000.

A fail-open bug disabled Google authentication on a public agent dashboard. The attacker prompted an agent to reveal the key and added SSH persistence.

How the exposed app was abused: https://thehackernews.com/2026/09/attackers-steal-metr-api-key-and.html

t.me/thehackernews/9932