The METR attacker spent three weeks inside a researcher's cloud instance and touched nothing sensitive. They burned roughly $600,000 in inference credits instead, and that should change how you handle your own keys more than any data breach this year.
Short version: a researcher ran agents on a personal, internet-facing EC2 instance holding a key to METR's general-access account. A vibe-coded agent app had a fail-open bug that silently disabled the Google auth in front of it. The attacker likely found it by scanning certificate transparency logs for LLM-flavored hostnames, then just asked the agent for its provider API key. The agent answered. Nobody noticed for three weeks, partly because METR's usage is enormous and spiky, partly because the credits were donated so there was no bill to trip over.
Stealing data is a business with friction: you need a buyer and a way to prove the goods are real. Stolen compute converts to value immediately. Run your own workloads or resell access through a proxied endpoint. This pattern has a name, LLMjacking, and METR is the cleanest public case of it working at scale. The attacker monetized the most liquid thing on the box, and it wasn't data.
Every recap name-checks spend alerts. I think that's backwards. Alerts alone tell you how bad the damage was. Scoping limits what a stolen key can buy. Caps decide how much it can cost.
My rules:
Then every key gets a hard monthly cap, roughly 2x to 3x its historical peak, soft alerts at 50% and 80%, a page at 95%. If the provider can't cap that key class (METR's exact situation), put the key behind an egress proxy or LLM gateway you control and enforce caps there:
- key: evals-batch-prod
scope: ["chat:completions", "batch"]
monthly_cap_usd: 12000
alert_at: [0.5, 0.8]
page_at: 0.95
- key: researcher-experiment-mk
scope: ["chat:completions"]
monthly_cap_usd: 200
Detection has to be per key, not per org. Three weeks of abuse hid inside METR's org-wide volume. An experiment key burning at 4x its own baseline on a Sunday at 3 a.m. stands out even when the org total looks normal. Also alert on off-schedule spend: evals run on schedules, thieves don't.
The moment you get a cert for agent-dashboard.example.com, the name sits on a public list that attackers grep for LLM and agent keywords. Assume it gets catalogued the day it goes up.
So test auth from outside, and test the error path, not just the happy path. METR's bug was fail-open. Run this from an unauthenticated context, on a schedule:
curl -s -o /dev/null -w "%{http_code}\n" https://agent-dashboard.example.com/
A 200 means auth just failed open. Test revoked tokens and an unreachable identity provider too. And watch CT logs for your own namespace. It's the same recon the attackers run, pointed inward.
What I'd do this week:
My claim to argue with: spend alerts as a primary control just make teams feel covered while scoping and caps do the real work. Agree?
Longer writeup with the full timeline and the PromQL alert rules: https://axeploit.com/blog/one-key-three-weeks-600000-attackers-are-cashing-out-ai-credits-not-data