Executive Summary
In March 2026, AI model evaluation nonprofit METR suffered a significant credential theft incident when attackers exploited a fail-open authentication vulnerability in a researcher's AWS instance containing API keys for public AI models. The attackers maintained persistence for three weeks, consuming approximately $600,000 in AI model credits. A separate May incident involved sustained reconnaissance and probing of METR's infrastructure, including attempts to access internal evaluation data through an inadvertently exposed SQL endpoint. Both incidents highlight critical security gaps in AI research organizations handling sensitive frontier model evaluations for major vendors including OpenAI, Anthropic, Google, and Meta. The attacks demonstrate how conventional cloud security failures can lead to substantial financial impact and potential intellectual property exposure in the rapidly evolving AI evaluation ecosystem.
Why This Matters Now
As AI evaluation organizations become critical infrastructure for frontier AI safety, their security posture directly impacts the entire AI supply chain, making them high-value targets for threat actors seeking access to advanced models and evaluation data.
Attack Path Analysis
Attackers discovered exposed AWS EC2 instances through reconnaissance of vibe-coded websites, exploited fail-open authentication vulnerabilities to access model provider API keys, established persistence via SSH keys, and consumed $600,000 in AI model credits over three weeks. A separate campaign involved sustained probing of public-facing infrastructure with automated agents attempting to access internal evaluation data through inadvertently exposed endpoints.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attackers conducted reconnaissance scanning recently registered vibe-coded websites to harvest exposed model provider API keys, discovering an AWS EC2 instance with fail-open authentication vulnerability exposed to public internet
MITRE ATT&CK® Techniques
Valid Accounts
Unsecured Credentials: Credentials In Files
Account Manipulation
Exploit Public-Facing Application
Brute Force: Password Spraying
Data from Information Repositories
Active Scanning: Scanning IP Blocks
Phishing
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Authentication Credentials Management
Control ID: 8.2.1
NYDFS 23 NYCRR 500 – Access Privileges
Control ID: 500.07
DORA – ICT Risk Management Framework
Control ID: Article 11
CISA ZTMM 2.0 – Identity and Access Management
Control ID: ID.AM-2
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
SOC 2 Type II – Logical and Physical Access Controls
Control ID: CC6.1
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
AI model evaluators face credential theft targeting API keys, enabling unauthorized access to proprietary models and substantial financial losses through stolen computational resources.
Information Technology/IT
Credential theft incidents expose critical infrastructure vulnerabilities in cloud environments, requiring enhanced monitoring, segmentation, and zero trust implementations for API security.
Research Industry
Research organizations handling sensitive AI evaluation data face targeted attacks seeking intellectual property access, requiring strengthened authentication and data classification controls.
Computer/Network Security
Security firms evaluating AI models become high-value targets for credential theft, necessitating advanced threat detection and secure hybrid connectivity solutions.
Sources
- AI Model Evaluator METR Hit by Credential Theft, Probinghttps://www.darkreading.com/identity-access-management-security/ai-model-evaluator-metr-credential-theft-probingVerified
- METR Security Incidents Disclosurehttps://metr.org/blog/2024-08-31-incident-disclosure/Verified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would have significantly constrained this AI research infrastructure attack by enforcing microsegmentation around exposed EC2 instances and controlling east-west traffic flows. The segmented architecture would likely have reduced the attacker's blast radius and limited their ability to access model provider APIs across the compromised environment.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Zero Trust fabric policies would likely have reduced the attack surface of exposed EC2 instances by implementing default-deny postures and constraining which services could be directly accessible from the public internet.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation policies would likely have constrained the agent orchestration tool's access to sensitive credential stores, reducing the scope of API keys accessible even after authentication bypass.
Control: East-West Traffic Security
Mitigation: East-west traffic controls would likely have restricted the attacker's ability to pivot between cloud services using compromised credentials, constraining their reachability to additional model provider endpoints and evaluation systems.
Control: Multicloud Visibility & Control
Mitigation: Continuous visibility and control mechanisms would likely have detected the unauthorized SSH key addition and anomalous outbound communication patterns, constraining the attacker's ability to maintain persistent command channels.
Control: Egress Security & Policy Enforcement
Mitigation: Egress controls would likely have constrained the volume and pattern of API calls to external model providers, reducing the scope of credit consumption and limiting data exfiltration through controlled outbound traffic policies.
While financial damages would likely still occur, the constrained blast radius from Zero Trust segmentation would have reduced the scope of affected systems requiring remediation and limited exposure of sensitive evaluation data.
Impact at a Glance
Affected Business Functions
- AI Model Security Evaluation
- Research Operations
- Third-party AI Assessment Services
- Intellectual Property Protection
Estimated downtime: 7 days
Estimated loss: $600,000
Potential exposure of unpublished AI model evaluation results, some sensitive model access data including private-model evaluation results and hidden chain-of-thought data. No evidence of actual data exfiltration in the May incident, but vulnerability existed that could have exposed category 2 and some category 3 classified data.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation with identity-based policies and least privilege access to prevent lateral movement from compromised instances to sensitive AI model infrastructure
- • Deploy Multicloud Visibility & Control with centralized policy enforcement to detect anomalous API usage patterns and repeated malformed requests against evaluation endpoints
- • Enable Egress Security & Policy Enforcement with FQDN filtering to prevent unauthorized data exfiltration and monitor outbound traffic to external model providers
- • Establish Threat Detection & Anomaly Response capabilities to baseline normal API consumption patterns and alert on suspicious automation or credential abuse
- • Implement Cloud Native Security Fabric (CNSF) with distributed policy enforcement to provide real-time inspection and control of AI agent interactions and autonomous systems
