aviatrix logoAviatrix
Under Active Attack

Executive Summary

In March 2026, attackers exploited a fail-open authentication vulnerability in METR's publicly accessible AI research infrastructure to steal API keys and consume approximately $600,000 worth of AI model credits. The breach occurred when a researcher's EC2 instance running agent orchestration software inadvertently exposed authentication-protected endpoints to the public internet for several days. Attackers likely discovered the vulnerable system through certificate transparency monitoring and automated scanning for AI-related infrastructure, then directly prompted the exposed AI agent to reveal its API credentials before establishing persistent access. A second incident in May 2026 involved sustained probing of METR's infrastructure and exploitation of an inadvertently exposed SQL query endpoint that could have provided access to sensitive AI evaluation data.

This incident highlights the emerging attack surface created by AI research infrastructure and the growing threat of credential harvesting targeting AI model providers. As organizations increasingly deploy AI agents and automated systems, the combination of high-value API access, complex authentication chains, and rapid development cycles creates new opportunities for financially motivated attackers to exploit cloud misconfigurations for significant monetary gain.

Why This Matters Now

AI infrastructure attacks are rapidly evolving as threat actors recognize the high-value nature of AI model access and API credits, making secure deployment of AI research environments and proper credential management critical priorities for organizations investing in frontier AI technologies.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

Attackers likely used certificate transparency monitoring and automated scanning to identify recently registered websites with AI-related keywords, then probed for exposed authentication endpoints.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF would have significantly constrained this AI infrastructure attack by limiting lateral movement between cloud workloads and controlling egress paths for API key abuse. The segmented architecture would likely have reduced the blast radius from the initial compromise and limited unauthorized access to sensitive AI model resources.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Zero Trust architecture would likely have isolated the AI orchestration dashboard from direct internet exposure through secure connectivity frameworks and workload segmentation policies

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Microsegmentation policies would likely have constrained the AI agent's access scope and prevented unrestricted credential exposure through workload-specific permission boundaries and identity verification requirements

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic controls would likely have limited the attackers' ability to probe additional infrastructure by restricting inter-workload communication paths and enforcing authentication for cross-service access

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Centralized visibility and control mechanisms would likely have detected and constrained the automated reconnaissance activities across multiple cloud services and restricted unauthorized service discovery attempts

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Egress controls would likely have constrained the volume and destinations of AI API calls, limiting the financial impact through usage quotas and traffic pattern analysis that detects abnormal consumption

Impact (Mitigations)

While some financial impact may still occur, the constrained lateral movement and limited egress paths would likely reduce the overall blast radius and prevent access to additional sensitive datasets

Impact at a Glance

Affected Business Functions

  • AI Model Evaluation Services
  • Research Operations
  • API Credit Management
  • Data Analytics Platform
Operational Disruption

Estimated downtime: N/A

Financial Impact

Estimated loss: $600,000

Data Exposure

Potential access to unpublished AI model evaluation data and sensitive model information through inadvertently exposed SQL query endpoint. No confirmed access to sensitive research data or proprietary AI model information.

Recommended Actions

  • • Implement Zero Trust segmentation with identity-based policies to prevent unauthorized access to AI infrastructure and enforce least privilege access controls for research environments
  • • Deploy egress security and policy enforcement to monitor and control outbound API calls, implementing spend limits and anomaly detection for AI model usage patterns
  • • Enable multicloud visibility and control with centralized policy management to detect suspicious automation patterns and repeated malformed requests across AI infrastructure
  • • Implement encrypted traffic controls and secure hybrid connectivity to protect AI model interactions and prevent credential harvesting from exposed endpoints
  • • Deploy threat detection and anomaly response capabilities specifically tuned for AI workloads to baseline normal usage patterns and alert on credential abuse or unauthorized model access

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsGet a Free Workload Attack Path AssessmentUnder Active Attack?
Cta pattren Image