{"slug": "metr-ai-infrastructure-compromise-fail-open-authentication-leads-to-api-key-ssh", "title": "METR AI Infrastructure Compromise: Fail-Open Authentication Leads to API Key Theft, SSH Persistence, and $600K in Unauthorized Usage", "summary": "METR, an AI model evaluation nonprofit, disclosed that a fail-open authentication flaw in a researcher's personal AWS-hosted AI agent orchestration dashboard allowed an attacker to steal API keys, establish SSH persistence, and consume approximately $600,000 in inference credits over three weeks. In a separate incident, a public SQL mechanism in METR's transcript viewer could have exposed unreleased evaluation data, though no unauthorized access was confirmed.", "body_md": "##\n1. Basic Information\n\n-\n**Article Title**: AI Model Evaluator METR Hit by Credential Theft, Probing\n-\n**Publisher**: Dark Reading\n-\n**Publication Date**: 2026-09-01\n-\n**Original Source**: [Dark Reading](https://www.darkreading.com/identity-access-management-security/ai-model-evaluator-metr-credential-theft-probing)\n-\n**Related Source**: [METR Security Update](https://metr.org/blog/2026-08-31-security-update/)\n-\n**Related Malware / Threat Groups / CVEs / Products**: METR, AWS EC2, AI agent orchestration tool, Google authentication, OAuth, public transcript viewer\n-\n**Severity**: High\n\n##\n2. Executive Summary\n\nAuthentication failed open in an AI agent orchestration dashboard hosted on a personal AWS instance. An attacker made the agent reveal its API keys, added an SSH key, and abused inference credits worth about $600,000 over three weeks. In a separate incident, a public SQL mechanism could reach internal evaluation data, but no unauthorized access to private data was confirmed.\n\n##\n3. Attack Flow\n\n###\nMarch: API Key Theft and Abuse\n\n- A researcher deploys an AI agent orchestration dashboard to a personal EC2 instance.\n- A fail-open vulnerability in the vibe-coded app silently disables Google authentication.\n- An attacker finds the public site and tricks the agent into revealing its model provider API key.\n- The attacker adds an SSH key for persistence.\n- The attacker uses the stolen key for three weeks and consumes about $600,000 in inference credits.\n\n###\nMay: Automated Discovery and Data Paths in Public Infrastructure\n\n- The attacker automates credential stuffing, OAuth token grants, scans, and phishing via agents.\n- The attacker probes the read-only SQL query mechanism of the public transcript viewer.\n- A bug chain makes it possible to reach unreleased evaluation data.\n- An independent researcher reports the issue, leading to the API being shut down.\n- No evidence is found that the attacker discovered the exploit or accessed private data.\n\n##\n4. Attacker Positioning and Execution Location\n\n- External attackers who can reach internet-exposed personal EC2 instances or public METR services.\n- In the March incident, the attacker connected to the personal EC2 instance after establishing SSH persistence and used the stolen API key from the outside.\n\n##\n5. Visibility for Victims and Administrators\n\n###\nVictims\n\n- Researchers believe Google authentication is active and find it hard to notice when authentication is silently disabled.\n\n###\nAdministrators\n\n- Agent activity from unknown sources right after public exposure, API keys displayed in logs, and changes to\n`authorized_keys`\n\n.\n- High token consumption that looks like normal evaluation traffic, increased rate-limit events, and model API usage from unknown sources.\n- A sequence of SQL queries against the public transcript viewer combined with OAuth and credential stuffing.\n\n##\n6. Success and Failure Conditions\n\n###\nSuccess Conditions\n\n- Authentication on the public dashboard fails open.\n- The agent has access to the provider API key and can reveal it based on prompts.\n- The API key lacks usage limits, source restrictions, and fast anomaly detection.\n\n###\nFailure Conditions / Risk Mitigation\n\n- Ensure authentication fails closed and subject public deployments to security reviews.\n- Do not bring corporate credentials into personal cloud environments; use short-lived, least-privilege keys.\n- Implement usage limits, rate-limit alerts, and visibility based on sources and users.\n\n##\n7. What Happens Upon Success\n\n- Theft of model provider API keys.\n- SSH persistence on the personal EC2 instance.\n- Unauthorized use of inference credits worth about $600,000.\n- Exposure of a path that could reach unreleased and partially sensitive evaluation data in a separate incident.\n\n##\n8. Observable Logs\n\n-\n**Email**: Phishing emails sent and received during the May campaign, spoofed senders, and OAuth redirection URLs.\n-\n**Proxy/SWG/DNS**: Unknown source access to newly exposed dashboards, and new domains easily discovered via certificate transparency.\n-\n**Endpoint/EDR**: Changes to `authorized_keys`\n\non EC2, unknown SSH sessions, and secrets displayed by agent processes.\n-\n**Identity/IdP**: Sessions bypassing Google authentication, credential stuffing, and OAuth token grant attempts.\n-\n**SaaS/Cloud**: Model API key sources, models, token usage, and rate limits, along with AWS security group and EC2 operation history.\n-\n**Network**: SSH and model API usage from unknown sources lasting for three weeks.\n\n##\n9. Attack Success Determination\n\n-\n**Attack Attempt Observed (Success Unconfirmed)**: Only scans, OAuth attempts, and credential stuffing against public services are confirmed.\n-\n**User Interaction Confirmed**: No user interaction was required for the March incident. Phishing in May may require user interaction, but success is unconfirmed.\n-\n**Initial Execution Confirmed**: The agent displayed the API key, and the attacker's SSH key was added.\n-\n**Malware Execution or Authentication Success Confirmed**: SSH persistence and continued use of the stolen API key are confirmed.\n-\n**Information Theft or Session Compromise Confirmed**: Consumption of about $600,000 in credits is confirmed. Access to private evaluation data is unconfirmed.\n-\n**Post-Compromise Activity Confirmed**: Lateral movement to other environments or Category 3/4 data breaches are not confirmed.\n\n##\n10. Investigation Playbook\n\n-\n**Trigger**: Sudden spikes in AI API usage, increased rate limits, authentication bypasses on public dashboards, and `authorized_keys`\n\nmodifications.\n-\n**Initial Check**: Check public deployment timestamps, authentication settings, EC2 images, key usage history, and the first unknown source.\n-\n**Endpoint**: Isolate and image the EC2 instance, and preserve SSH logs, `authorized_keys`\n\n, agent transcripts, processes, and files.\n-\n**Identity and Cloud**: Inspect Google/OAuth, AWS, and model provider keys, sessions, sources, and usage volumes.\n-\n**Post-Exploitation Actions**: Check for other keys, internal data, public viewers, other personal cloud environments, and phishing impacts.\n-\n**Containment**: Stop public services, rotate keys and credentials, delete SSH keys, and revoke researcher access. Isolate public environments from internal infrastructure and resume only after a security review.\n-\n**Classification**: Separate reconnaissance, authentication bypass, key disclosure, SSH persistence, credit abuse, and data breaches.\n\n##\n11. Defense and Detection Ideas\n\n-\n**Single Event**: An agent returns secret strings during operations without a successful authentication event. Unknown keys are added to `authorized_keys`\n\non personal EC2 instances.\n-\n**Time-Series Correlation**: Correlate new deployments -> authentication bypasses -> agent secret disclosure -> SSH key additions -> massive model API usage.\n-\n**Threat Hunting**: Retrospectively check public AI services including personal and test clouds, API key usage volumes, rate limits, and OAuth attempts.\n-\n**Log Gaps**: Without visibility into rate-limit requests, free credits, source-specific key usage, and agent transcripts, abnormal usage gets buried in normal evaluation traffic.\n-\n**Priority Actions**: Prioritize public deployment reviews, fail-closed authentication, key limits, alerts, bans on storing secrets in personal clouds, and environment segregation.\n\n##\n12. Facts / Inference / Hypothesis\n\n###\nFacts\n\n- In March 2026, a fail-open vulnerability silently disabled authentication on an AI agent orchestration dashboard deployed by a researcher on a personal EC2 instance, exposing it to the internet for several days.\n- The attacker made the agent reveal its model provider API key, added an SSH key, and used public model inference credits worth about $600,000 over three weeks.\n- Discovery was delayed because high token consumption looked like normal evaluation processing, rate-limited requests were not shown on the dashboard, and free credits had no spending caps.\n- In May 2026, the attacker used agents to automate credential stuffing, OAuth token grants, public service scans, and phishing.\n- Around the same time, a read-only SQL query mechanism was exposed via the public transcript viewer, allowing potential access to unreleased evaluation data through a bug chain, though no unauthorized access by the attacker was confirmed.\n\n###\nInference\n\n- In AI research and evaluation environments, high inference spending easily looks like normal business activity, requiring correlation across spending amounts, keys, users, sources, models, and rate-limited requests.\n\n###\nHypothesis\n\n- METR's explanation that attackers discovered newly registered AI-related sites via certificate transparency is an inference based on investigation.\n\n##\n13. MITRE ATT&CK Mapping\n\n-\n**T1190 Exploit Public-Facing Application (High)**: Targeted the fail-open authentication on the public dashboard and the bug in the public transcript viewer.\n-\n**T1552.001 Unsecured Credentials: Credentials In Files (Medium)**: Retrieved model provider API keys via the agent.\n-\n**T1098.004 Account Manipulation: SSH Authorized Keys (High)**: The attacker added an SSH key for persistence.\n-\n**T1078.004 Valid Accounts: Cloud Accounts (High)**: Used the stolen API keys for three weeks.\n\n##\n14. Unknowns and Further Investigation\n\n- The attacker's identity and the full scope of abused models and sources.\n- The possibility that credentials other than API keys or other data were viewed.\n- Whether the attackers behind the May campaign and the March incident are the same.\n\n##\n15. Impact on SOCs and General Organizations\n\nAI research and development teams face similar risks if they use production credentials in personal cloud environments or test dashboards. Organizations need security reviews for public deployments, fail-closed authentication, short-lived keys, usage monitoring including spending limits and rate limits, and segregation of public environments from internal data.\n\n##\n16. Summary by Role\n\n-\n**For SOCs**: Monitor AI API usage including keys, users, sources, and rate limits, and correlate SSH `authorized_keys`\n\nchanges with new public service deployments.\n-\n**For Administrators**: Prohibit bringing corporate credentials into personal cloud environments, and implement public deployment reviews, fail-closed authentication, spend alerts, and short-lived, least-privilege keys.\n-\n**For Users**: Get administrative reviews before exposing prototype AI apps to the public, and do not place corporate API keys or internal data in personal environments.", "url": "https://wpnews.pro/news/metr-ai-infrastructure-compromise-fail-open-authentication-leads-to-api-key-ssh", "canonical_source": "https://dev.to/anoymask/metr-ai-infrastructure-compromise-fail-open-authentication-leads-to-api-key-theft-ssh-c82", "published_at": "2026-09-02 04:11:07+00:00", "updated_at": "2026-09-02 04:24:22.715794+00:00", "lang": "en", "topics": ["ai-safety", "ai-infrastructure", "ai-agents"], "entities": ["METR", "AWS EC2", "Google", "OAuth"], "alternates": {"html": "https://wpnews.pro/news/metr-ai-infrastructure-compromise-fail-open-authentication-leads-to-api-key-ssh", "markdown": "https://wpnews.pro/news/metr-ai-infrastructure-compromise-fail-open-authentication-leads-to-api-key-ssh.md", "text": "https://wpnews.pro/news/metr-ai-infrastructure-compromise-fail-open-authentication-leads-to-api-key-ssh.txt", "jsonld": "https://wpnews.pro/news/metr-ai-infrastructure-compromise-fail-open-authentication-leads-to-api-key-ssh.jsonld"}}