Attackers stole a METR API key and consumed credits worth about $600,000, while a later campaign failed to access internal ...