METR Blew $600K of Free AI Credits on One Fail-Open Auth Bug (Their Own Postmortem)
An AI research lab published how an attacker found their agent dashboard by scanning certificate-transparency lists, prompted the agent to hand over its model API key, added an SSH key for persistence, and burned ~$600K of free credits in three weeks — with no bill to notice.