METR discloses 2 security incidents, including $600,000 model credit theft

The first incident, in March 2026, saw attackers steal an API key for public model inference.