AI research non-profit METR disclosed two real security incidents. In one, attackers got access to an exposed system and used an AI agent to reveal an API key, then burned through about $600,000 in AI credits over weeks. In a separate incident, METR observed systematic probing of its public infrastructure, including credential stuffing and attempts to phish staff.
An AI research non-profit, METR, disclosed two related security incidents. In the first, a researcher had set up agents on a personal EC2 instance that was intentionally made public but was meant to be protected behind Google authentication. A fail-open vulnerability in the app silently disabled that authentication, exposing the system to the public internet for several days. An attacker found the exposed system and prompted the AI agent directly to reveal its model provider API key. The attacker then added an SSH key for persistent access and used the stolen credentials over roughly three weeks, consuming about $600,000 worth of AI credits.
In a separate incident, METR observed systematic probing of its public infrastructure. This included credential stuffing against authentication providers, attempts at OAuth token grants, scanning of newly deployed services, and attempts to phish staff. METR said it had been tipped off that it was being targeted by financially motivated actors who may have been looking to obtain frontier model access.
The core failure was not a complex exploit but a design gap: an authentication mechanism that was supposed to gate access failed open rather than closed, silently removing protection instead of blocking access. Combined with an AI agent that would respond to a direct request for its own API key, this created a straightforward path to credential theft. The incident also went unnoticed for weeks because METR is accustomed to running evaluations and experiments that use large volumes of tokens, and dashboards did not clearly surface rate-limited request data that would have flagged the abuse.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
They accessed a personal EC2 instance meant to be behind Google authentication, but a fail-open vulnerability silently disabled that authentication, exposing the system publicly. The attacker then prompted the AI agent directly to reveal its model provider API key.
METR is accustomed to running evaluations that use large volumes of tokens, so the unusual usage did not immediately stand out, and dashboards did not clearly show rate-limited request data.
In a separate incident, METR observed systematic probing of its infrastructure, including credential stuffing against authentication providers, attempts at OAuth token grants, and attempts to phish staff.
Treat AI agents like staff who should never reveal secrets through chat interfaces, and require secure-by-default authentication and review before exposing anything to the internet.
An AI lab burned six hundred thousand dollars because an agent literally printed its own API key on command. At METR, a personal EC2 demo app was left public. A fail-open bug quietly disabled Google login, so anyone could talk to the agent. The attacker just asked it for the model provider API key, grabbed it, added an SSH key, and ran up credits for three weeks. Here’s the scary part: METR almost missed it because huge token usage looked like normal experiments. At the same time, they saw automated probing, credential stuffing against login providers, OAuth consent attempts, and phishing emails like "Action required: confirm your account to retain frontier model access." Treat agents like teammates: they must never see or print API keys. If you’re building a demo or side project, one rule, before it goes on the internet, strip secrets out of the agent and lock real keys behind proper auth.
Researchers found real GitHub repositories containing poisoned AI-agent instruction/config files (like CLAUDE.md and .cursorrules) that silently tell coding assistants to steal prompts, environment variables, and credentials. The malicious instructions can trigger hidden commands (for example, curl…
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
Researchers found a large recruitment-themed phishing campaign where victims receive unsolicited interview invites and are sent to fake scheduling or recruitment pages. The pages use “Browser-in-the-Browser” fake login popups to steal Google/Facebook passwords and, in some cases, capture MFA codes…
A real phishing campaign is tricking employees with a “missed voicemail” message that claims they have a new audio message. Clicking “Play Audio” sends victims through multiple trusted-looking redirects and ends on a fake Google sign-in page that captures Google Workspace credentials, potentially…
Researchers found nearly 800 malicious npm packages that trick developers into installing them through typo-squatted package names and believable documentation. Instead of auto-running on install, the packages rely on the developer following README instructions to load the module, which then…
