Post

Flo 🔶
@faz.ms

Seems it was a vibe-coded public app + prompt injection + an org where burning the equivalent of $600.000 in tokens is just your regular Tuesday. metr.org/blog/2026-08...

mr. TIM@timkellogg.me

METR, the AI Safety & Eval firm, experienced a breach in which attackers stole $600k worth of API credits thehackernews.com/2026/09/atta...

thehackernews.comAttackers Steal METR API Key and Consume AI Credits Worth About $600,000Attackers stole a METR API key and consumed credits worth about $600,000, while a later campaign failed to access internal data.

1 repost14 likes

No replies yet.