A vibe-coded METR dashboard exposed an agent that surrendered a $600,000 API credential.

METR disclosed the incident in a security update.

The agent ran inside a researcher’s personal EC2 instance, where a vibe-coded dashboard silently failed open and disabled Google authentication.

METR suspects attackers found the service through certificate-transparency lists, then directly prompted the agent to surrender its provider key.

Attackers used the stolen key for three weeks, consuming $600,000 worth of AI credits that METR had received for free.

The abuse blended into normal evaluation traffic because METR routinely generates large token volumes, while free-credit keys had no spend ceiling.