Attacker stole a METR API key, used $600K worth of credits, and no one noticed for weeks
What happened
The model provider gave METR the credits for free. An actual customer would not have been so lucky
Summary assembled by rule from the sources below