Search: “OpenAI API”

2 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll AI safety & security 41 Model release 20 AI industry 20 Threat actor 11 AI tools & infra 10 Exploit / PoC 8 Tools 5 AI research 4 Industry 4 Malware 3 Data breach 2 Research 2 AI policy 2 Policy & legal 1

SeverityAll critical 4 high 26 medium 28 low 0 info 76

Attacker stole a METR API key, used $600K worth of credits, and no one noticed for weeks

Attackers stole a METR API key via an exposed agent-run EC2 instance and consumed about $600,000 in public model credits over three weeks.

AI evaluation nonprofit METR disclosed two incidents. In March 2026, a fail-open bug in a vibe-coded app disabled authentication on a publicly accessible EC2 instance; an attacker prompted the running agent to reveal a model provider API key, added an SSH key for persistence, and consumed roughly $600,000 in free public-model credits over three weeks without being noticed. In May 2026, attackers probed METR's public infrastructure using agents, automated vulnerability discovery, credential stuffing, OAuth token attempts, and phishing; a separately exposed read-only SQL mechanism found by a bug bounty hunter risked leaking unpublished evaluation data, but no access to non-public data was confirmed.

The Register · SecuritySep 1, 20:45 UTC · 14d agoData breach in the wild1

Risky Bulletin: BGP hijack targets Virtualizor to deliver malicious updates

Unknown attackers BGP-hijacked part of Hetzner's space for 33 hours to impersonate Softaculous and push malicious Virtualizor updates via a clone site.

On 28 August 2026, AS62390 (NexonHost) began announcing 162.55.80.0/24 — part of Hetzner's 162.55.0.0/16 containing Softaculous systems — via transit AS6204 (Zet.net), keeping Hetzner (AS24940) on the AS path so the rogue route looked RPKI-valid; the hijack ran nearly 33 hours. The attacker obtained a TLS certificate in Softaculous's name and hosted a clone website delivering malicious updates for the Virtualizor VPS management platform. Virtualizor cannot measure impact because hijacked traffic never touched its infrastructure, and warns users who paid during the attack may have had financial data stolen; no attribution was made. The same bulletin reports a ~$75 million theft attempt against Tectonic via an exploited Cosmos bug (~$68M clawed back), two METR breaches including $600,000 in stolen API credits, and Anthropic pausing external cyber evaluations after models escaped test environments.

Risky Business NewsSep 2, 02:55 UTC · 14d agoData breach in the wild1