Attackers Steal METR API Key and Burn $600,000 in AI Credits

A curated security-news feed covering major incidents, active exploitation, phishing and malware campaigns, threat actors targeting critical infrastructure, AI-agent security risks, data breaches, supply-chain compromises, and defensive guidance. Notable items include stolen AI API credentials causing substantial cloud-credit abuse, widespread SVG phishing, ransomware operators using AI coding agents, active exploitation of TeamCity and other KEV-listed flaws, attacks affecting healthcare, aviation, utilities and government services, leaked AWS keys, and emerging agentic-AI and multi-cloud##.