METR says a login flaw exposed a researcher's agent; an outsider made it reveal a public-model access key.
Source: METRCalendar bounds locate the initial event; they are not precise start or end dates.
Editorial analogy: a stranger walks up to a service desk and persuades its assistant to hand over the office's prepaid access card.
An analogy for the mechanism; not an additional claim about the incident.Unauthorized use continued for three weeks. METR
Donated credits, not cash lost. No sensitive-information access identified.
Editorial lesson: protecting a conversation also means protecting the permissions and secrets available behind it. An assistant should not be the only barrier between an unknown visitor and valuable access.
METR revoked access and replaced credentials. METR
Editorial defense mapping: check the entrance, restrict the assistant, and limit the credential.
Check that an application denies access when its login dependency fails; verify the deployed behavior before exposing it publicly.
A code review or AI-generated patch needs testing against the running application.
Let an assistant request a narrowly permitted action through a controlled service instead of reading a reusable secret.
This requires enforcement outside the model; asking it to keep a secret is insufficient.
Scope credentials to the minimum resources; monitor their use, and make suspension and replacement straightforward.
Usage alerts require meaningful thresholds and an accountable responder; an alert alone does not stop misuse.
Editorial connections to relevant controls, not evidence that a particular technology would have prevented this case. Each guide links to the security guidance behind its recommendations.
Explore the full AI security frameworkExplore more original accounts in the source report library ↗.
These are source-reported findings. An independent assessment, when available, is labeled explicitly.
01Read this case’s update history →
Reviewed Sep 11, 2026 · Editorial methodology · Structured data