Contain exposed agent interfaces and protect credentials

The METR account shows a complete exposure chain rather than a theoretical weakness: fail-open authentication exposed a public EC2 agent dashboard, an attacker reportedly requested the model-provider key through the agent, installed an SSH key, and used the provider credential for three weeks.

That duration makes immediate revocation, host investigation, and spending limits more valuable than waiting for the exact retrieval mechanism. The evidence record is bounded through September 1, 2026, and does not establish current active exploitation beyond the reported event.

The directly evidenced deployment is METR’s public EC2-hosted agent dashboard with fail-open authentication; its operators faced unauthorized agent access.

The model-provider account tied to the disclosed API key faced three weeks of unauthorized consumption, reported at roughly $600,000 in donated-credit value rather than cash. The EC2 host and its administrators faced persistence through an attacker-installed SSH key.

The guidance also applies to operators of internet-exposed agent interfaces where an agent can read or output provider credentials, to cloud and identity teams managing those EC2 hosts and keys, and to billing owners exposed to uncapped provider consumption.

No dashboard product, release version, EC2 operating-system version, authentication-component version, or model provider is identified in the evidence.

Support — The first AI-security analysis says fail-open authentication exposed METR’s public EC2-hosted agent dashboard, the attacker instructed the agent to reveal its model-provider key, an SSH key was installed, and the provider credential was used for three weeks.

It clarifies that roughly $600,000 represented donated-credit value, not a cash payment.

Support — The follow-up AI-security analysis classifies the event as an AI-application security failure layered onto conventional cloud exposure and identifies non-exportable credentials as the agent-specific control.

Support — The moderator’s synthesis agrees that the fail-open EC2 application was the entry point and that reported agent-mediated provider-key disclosure completed the high-value impact path.

Support — The final Roundtable synthesis classifies METR as a hybrid application, cloud, and agent-control failure.

Evidence gap — The checked material does not establish the precise technical path used to retrieve the provider key, supporting mechanism-neutral guidance rather than a narrower forensic claim.

The AI-security contributor initially classified the METR event mainly as a conventional application, identity, and cloud-control failure.

After that classification was challenged, the contributor narrowed it to a hybrid incident: fail-open authentication exposed the EC2 agent dashboard, while reported agent-mediated disclosure of the model-provider key completed the high-value loss path.

The moderator adopted that hybrid classification, and the final synthesis confirmed it.

The evidence review found consistent support for interface isolation, credential revocation, host containment, non-exportable credential brokering, and consumption limits, while separating out the unresolved key-retrieval mechanism.

The final decision retained the controls because they do not depend on proving that mechanism. A bounded search found no earlier Decision Record addressing this combination of controls.