ACVE-2026-0523

About $600,000 of public-model credits were consumed after an attacker prompted the agent in a researcher's exposed personal EC2 deployment of METR tooling to reveal a model-provider API key.

Exposure

Evidence: Real use · operator report
METR acknowledged: METR revoked access, rotated credentials, and added monitoring and spend alerts. — metr.org
Harness: A researcher's personal EC2 instance running a publicly accessible deployment of METR tooling — confirmed, metr.org
Model: any public model available through the dashboard — confirmed, metr.org
Goal: Reveal the model-provider API key — confirmed, metr.org
Tools and settings: Agent dashboard with access to a model-provider API key — confirmed, metr.org
Approval: The dashboard's authentication failed open, allowing the attacker to prompt the agent directly — confirmed, metr.org
Input controlled by: operator
What the agent does: The agent reveals the model-provider API key to the attacker.
Harm: credential-theft

Reach: The researcher's personal EC2 deployment, model-provider API key and inference credits — confirmed, metr.org (API keys, funds)
Condition: When the publicly exposed dashboard's authentication silently failed open — confirmed, metr.org
Scale: Credits worth approximately $600,000 were consumed — 600000 dollars, metr.org

Reproducibility: partial (model availability not checked (no registry reference); trigger not published)

Severity: CRITICAL · harm and reach
Status: Unverified
Kind: Behavioural
Modified: 2026-09-25
Aliases: No CVE assigned — No code defect: the harm arises from the agent pursuing the attacker's goal in this configuration.
Affected: AgentHarness: metr-agent-dashboard — all versions
Harness/product: metr-agent-dashboard
Classes: credential-exposure; over-privileged-combination; CWE-522; CWE-693
Taxonomy: ASI: ASI03; ASI: ASI01; ATLAS: AML.T0132; ATLAS: AML.T0051.000; ATLAS: AML.T0083
First reported: 2026-08-31 — METR
Licence: CC-BY-4.0 advisories; MIT code

Claims

Confirmed means the statement matches the cited primary source. Nothing on this page has been reproduced.

Claims on this page have not been checked against primary sources.

Description

Threat

user · unsafe-default · exfiltration

What

METR says an attacker found a researcher's personal EC2 instance running a publicly exposed deployment of METR tooling, prompted the agent to reveal a model-provider API key, and used the stolen credentials for three weeks of public-model inference. METR estimates the credits at about $600,000 and says no sensitive information was accessed.

Detection

The personal deployment was exposed for several days because authentication failed open. Recorded from METR's security update. Not recreated in a lab.

Fix

Keep agent deployments and model-provider credentials behind enforced authentication, add spend alerts, and rotate exposed credentials.

Fix

Enforce authentication and rotate exposed model-provider credentials.

Reconfigure agent.approval to ask. An external caller should not be able to direct a publicly exposed agent to disclose credentials. Owner: operator
Reconfigure metr.tooling.auth to fails closed. Recommended: authentication failed open and left the deployment exposed for several days. Owner: harness-vendor
Reconfigure model-provider.api.keys to alerts when a key's usage jumps. Recommended: the stolen key ran about $600,000 of inference over three weeks. Owner: model-provider

Report a problem JSON