METR had two notable security incidents earlier this year: attackers stole an API key for public models, and later systematically probed our publicly accessible infrastructure. We believe no sensitive information was accessed in either incident, and we describe what happened and how we responded.