Zero Trust for AI Agents Starts With Fixing Zero Visibility
Guidance says AI-agent Zero Trust needs inventory first, citing shadow agents and a $600,000 METR token theft.
46
- Mentions · 7d0
- Mentions · 30d0
- All mentions6
- First seenSep 1, 2026
- Last mentionedSep 26, 2026
Timeline
6 articles · newest firstRisky Bulletin: BGP hijack targets Virtualizor to deliver malicious updates
Unknown attackers BGP-hijacked part of Hetzner's space for 33 hours to impersonate Softaculous and push malicious Virtualizor updates via a clone site.
65
Attacker stole a METR API key, used $600K worth of credits, and no one noticed for weeks
Attackers stole a METR API key via an exposed agent-run EC2 instance and consumed about $600,000 in public model credits over three weeks.
58
AI Model Evaluator METR Hit by Credential Theft, Probing
Threat actors stole an API key from AI evaluator METR and consumed $600,000 in public model credits; a second campaign probed its infrastructure.
55
Attackers Steal METR API Key and Burn $600,000 in AI Credits
Attackers used a stolen METR API key for three weeks, burning $600,000 in AI model credits before the abuse was stopped.
45
Attackers Steal METR API Key and Consume AI Credits Worth About $600,000
METR disclosed attackers stole an API key and burned about $600,000 in inference credits, plus a second probing campaign against its infrastructure.
52
Appears with
- METRorganization · 6
- OpenAIorganization · 3
- Amazon EC2product · 2
- Hugging Faceorganization · 2
- Amazon Web Servicesvendor · 2
- Googlevendor · 2
- Unidentified threat actorthreat actor · 1
- Veeamorganization · 1
- OpenAIvendor · 1
- SANSorganization · 1
- NexonHostvendor · 1
- METRvendor · 1
- Anthropicorganization · 1
- Tectonicorganization · 1
- Virtualizorvictim · 1
- Virtualizorvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.