Attacker stole a METR API key, used $600K worth of credits, and no one noticed for weeks

The model provider gave METR the credits for free. An actual customer would not have been so lucky