How to hack a turned-off computer, or running unsigned code in Intel ME [pdf]
Money quote, though this may be slightly old news and this is just a summary of known information:<p><pre><code>  One of the most common questions regards
  the possibility of remote exploitation.
  We think that remote exploitation is possible
  if the following conditions are true:
    1. The target platform has AMT activated.
    2. The attacker knows the AMT administrator
       password or can use a vulnerability to
       bypass authorization.
    3. The BIOS is not password-protected (or
       the attacker knows the password).
    4. The BIOS can be configured to open up
       write access to the ME region.
  If all these conditions are met, there is no
  reason why an attacker would not be able to
  obtain access to the ME region remotely.

  Also note that during startup, the ROM does
  not check the version of firmware, leaving the
  possibility that an attacker targeting an
  up-to-date system could maliciously downgrade
  ME to a vulnerable version.
</code></pre>
That list of conditions does not seem incredibly unusual to me. Consumer hardware should have AMT disabled and be safe, but on business machines the highest bar is an AMT vuln, and given the huge size and apparently terrible code quality of the AMT I expect to be seeing auth bypasses for it on a regular basis.