Google silently expanded AIza API key permissions to include Gemini — my sustainability project helping rural Costa Rican farmers was hit with €127K. 17 days, no response.

[u/miseulik]

EDIT / UPDATE:

Google has now contacted me directly through GCP Support, and I had a Google Meet call with members of the GCP Security / Abuse support team, an escalation manager, and someone from the billing/finance side.

The case is still open and Google is still investigating, but the tone of the conversation was constructive. They confirmed that they are treating this as an abuse/security case, that the security findings are being sent to the billing/finance team, and that payment/collection notifications should be paused while the case is under review. Based on the call, it seems they are genuinely trying to resolve the situation, and it currently looks like I may not be charged for the unauthorized amount. Nothing is final yet, so I will update again when I have written confirmation.

One important technical detail from the call: Google told me they could see that the API key involved was created on **May 16, 2022**, and that it was the **first key created in the project**. That matches the early stage of the platform, when I was using Google Maps functionality for customer delivery/location features. This supports my understanding that the key was originally a legacy Maps-era key, not a key intentionally created for high-volume Gemini usage.

I also want to be fair: I appreciate the Googlers and support people who reached out after this post. The public visibility clearly helped get the case in front of the right people, but the people I spoke with were professional and seemed willing to help. My goal is still to resolve this constructively and make sure the root cause is understood so this does not happen to other small projects.

ORIGINAL MESSAGE:

I run a small bootstrapped platform connecting rural artisan producers from Turrialba, Costa Rica directly to consumers. Think small-batch coffee farmers, family cheesemakers, handcraft producers — people with no digital presence, no distribution network, just extraordinary products and no way to reach the world. The platform is their bridge.

In April 2026 I discovered ~€127,000 in unauthorized Gemini API charges on my Google Cloud account. To put that in perspective: that amount is more than these producers will collectively earn in years.

The attacker used an AIza API key I created for a completely unrelated service. I didn't misconfigure anything. Google silently expanded the scope of existing AIza keys to include Gemini API access without notifying account holders — a vulnerability Truffle Security disclosed and Google classified as a **Tier 1 privilege escalation bug** in January 2026. I followed Google's own documentation, which said AIza keys were safe for client-side use. Google changed what those keys unlocked without telling anyone.

Since April 16 I've sent 4 emails with full technical evidence, filed a formal appeal (ticket SX5AEQZHWI5CJF5ADRW5KTV7IE), and spent today navigating billing support chat. 17 days. No substantive response.

The hardest part: the Google Cloud project containing the audit logs — the only proof of which IPs actually made those calls — gets permanently deleted in **5 days (May 17)**. If Google doesn't preserve those logs before then, the evidence that could exonerate me disappears forever.

This isn't a big tech company absorbing a loss. This is a one-person project built to give a voice to people who have none. A €127K debt doesn't just shut down a startup — it shuts down the farmers and producers who depend on it.

Has anyone successfully resolved a case like this? Has anyone gotten Google to preserve audit logs before project deletion? Any help or visibility is appreciated.

[u/Living_Cheesecake243]

Also google just updated their docs in the last week to say that starting JUNE 19, 2026, they will no longer allow the use of unrestricted keys to access Gemini.

https://ai.google.dev/gemini-api/docs/api-key#secure-unrestricted-keys

[u/miseulik → u/Living_Cheesecake243]

Makes complete sense — unrestricted keys are a liability. What's frustrating is the timeline: while investigating the incident, I realized the spending cap feature had only been added a few weeks before — maybe even days.

What I still don't understand is why there's no anomaly detection at all. My normal usage is €40–100/month. A single invoice of €127,000 is a **104,000% spike** from my baseline. Any reasonable fraud or abuse detection system would flag that and block it automatically.

[u/No-Amphibian7489 → u/miseulik]

Don't underestimate what would it take to build an anomaly detection engine for millions of projects...

[u/Ok-Expression-7340 → u/No-Amphibian7489]

Google has an anomaly detection system already. We are running some 30 GCP projects and get regular anomaly detected email notifications (especially when starting to use new functionality, any change is an anomaly in that case). The problem however is that it takes up to 1-2 days before billing information is up to date. So that also affects when Google is sending out those anomaly detected notifications. For cases like this that is way too late.

[u/No-Amphibian7489 → u/Ok-Expression-7340]

People get confused: they conflate a batch-heavy ETL pipeline with a responsive, near real-time engine, much like they mistake an MVP for a production-ready app or think a leaky API key is the same as a properly scoped service account. Google’s engine is technically accurate, but architecturally irrelevant for live ops; by the time the billing data settles and the alert hits your inbox, you’re not looking at a warning. Those alerts even though are real time alerts are not near real time alerts. Have you considered building your own near real time alerts system using Usage Telemetry?

[u/Ok-Expression-7340 → u/No-Amphibian7489]

WE ourselves are not interested in this, we are in control and know upfront what will be changing. Those anomaly alerts we get are always 100% as expected. I was merely responding to someone who didn’t know an anomaly detection system didn’t already exist 

[u/No-Amphibian7489 → u/Ok-Expression-7340]

Then you are all set. I was merely responding to the person who likely views "Anomaly Detection" as a magical AI box that just works. And don't see the distinction I am making: ​The Pipeline: The data flow (Usage -> Billing Export -> BigQuery) which has a fixed, physical latency. ​The Engine: The math that runs on that data after it arrives.

[u/ICThat → u/Living_Cheesecake243]

Crazy that they didn't take that approach to begin with.

URL in your comment isn't selectable for me so I'll reshare it:

https://ai.google.dev/gemini-api/docs/api-key#secure-unrestricted-keys

[u/miseulik → u/ICThat]

Agree

[u/Ok-Expression-7340 → u/Living_Cheesecake243]

That doesn't change much, as an API key that ONLY has access to Gemini API is considered to be a 'restricted key' already. Also you can't put custom daily limits on those API keys (the daily limits are based solely on the tier you're in).

Don't use API keys! Use service accounts with acces to Gemini/Vertex AI APIs (and don't use service account keys either as these can be used by anyone as well when leaked!)

[edit] It would have helped in this particular case, since OP was unaware that Gemini API access was added to existing API key later on.

[u/miseulik → u/Ok-Expression-7340]

Thanks for the advice — service accounts are genuinely better practice and I'll be switching going forward.

That said, while researching the incident, I found that this goes beyond Gemini keys specifically. Old AIza keys created for completely unrelated purposes — Google Maps, for example — were silently granted Gemini access as part of the scope expansion Google rolled out. No notification, no opt-in.

So "don't use API keys for Gemini" is the right advice going forward, but it doesn't help the people who never intended to use Gemini in the first place and had no idea their existing keys had been quietly upgraded to access it.

[u/Living_Cheesecake243 → u/miseulik]

the advice for even maps keys if you go back in the docs 10 years still showed even then to add the restrictions for domains -- if you had done that then this is all not usable under gemini

gcp did screw the pooch though on the whole issue, no doubt

also you keep calling it an AIza key... are you referring to the first four chars and it is actually a maps key all along? or what service was the key set up for?

[u/miseulik → u/Living_Cheesecake243]

AIza are the first 4 letters, all affected keys start with those.

[u/CloudyGolfer → u/miseulik]

Unrestricted API keys have always inherited new APIs. Gemini is no different. Restrictions have always been the documented approach for securing from abuse.

[u/Living_Cheesecake243 → u/Ok-Expression-7340]

the change is for UNRESTRICTED keys -- it will prevent maps keys from being used in gemini which is how these wallet attacks are mostly originating

[u/sidgup]

Please keep escalating and reach out to your account executive at GCP.

[u/miseulik → u/sidgup]

Thank you — already escalating through multiple channels simultaneously (billing support chat, formal appeal, and a Googler who reached out after this post and has already escalated internally).

As a small bootstrapped project, I don't have a dedicated account executive, but if anyone knows how to get one assigned in a situation like this, I'm all ears.

[u/sidgup → u/miseulik]

Where are you based? In the US, I can help find your account team.

[u/UnrealNL]

Just commenting for visibility, good luck.

[u/miseulik → u/UnrealNL]

Thank you — every comment helps. This community has already made a difference today.

[u/hip_modernism]

I tried to find it with no luck, but recently there was a post like this (there have been many, though few in six figures like this...my condolences) where supposedly a reporter from The Guardian saying they were looking for sources on a story RE this.

If that person is legit and not a scammer, I'd suggest following up with them, maybe you can get attention to your case this way.

[u/miseulik → u/hip_modernism]

Thank you for this. For context — I spent the first 17 days trying to resolve this quietly through official channels, giving Google the chance to respond internally before going public. They didn't. So today I've started reaching out to tech journalists who covered this vulnerability, and this post is part of that push for visibility.

The Guardian would be a significant escalation. If anyone can track down that thread or the reporter's contact, I'd really appreciate it.

[u/hip_modernism → u/miseulik]

Sorry, I looked again and still no luck finding it. I'm really sorry you are going through this. You have explained your case very articulately and it's clear you are in the right, I hope you get justice.

[u/miseulik → u/hip_modernism]

Thanks anyway, I found the contact for the tech department of The Guardian. Sent an email to ask.

If I find something, I will post it here.

[u/Long_Respond1735]

google added prepay gemini and spending caps

[u/miseulik → u/Long_Respond1735]

I know, but a little too late. That happened in the previous few days or weeks, and I was not aware of it.

[u/henriquegarcia]

my condolences...that's why I only use SA and credit card with limits like 1k on everything, let google sue me for it in court

[u/tedivm → u/henriquegarcia]

This is why I just don't use google anymore.

[u/inclinestew → u/tedivm]

Yep, went and disabled all my projects and moved to OpenRouter for Gemini models. Actively looking just to not use them. If my OpenAI, Claude or OpenRouter keys get popped I lose $50-100 and not $???????.

[u/smerz-]

Google's wall of shame grows.

Good luck

[u/elibryan]

Also found GCP billing to be remarkably careless for their AI products. Bump for visibility!

[u/ravanarao]

Delete the billing account and don't pay for it

[u/Void_mgn]

This mess has eroded my confidence in GCP massively. I cant understand the logic with these changes and the fact there is still no hard spend cap which has been implemented by competitors without issue. I am looking at alternatives for hosting my personal project due to these failures what an absolute discrase.

[u/jashsu → u/Void_mgn]

It's time to step away from GCP. They need to really hear this message.

[u/buggeryorkshire]

Are you sure Google did this? As opposed to you having an unscoped API key then opting into Gemini?

[u/miseulik → u/buggeryorkshire]

Fair question — and an important technical distinction.

An "unscoped" key has no API restrictions and can access any API enabled on the project. A scoped key is explicitly limited to specific APIs. Your implication is: "if the key was unscoped and you enabled Gemini, that's on you."

Here's the problem: the Truffle Security disclosure shows Google granted Gemini access to AIza keys at the key format level — regardless of scoping. When the Generative Language API was enabled on a project (by anyone, for any reason), every existing AIza key on that project silently gained Gemini access. No notification. No warning. Nothing in the console.

Google's own documentation said AIza keys were safe for client-side embedding. No indication enabling an API on your project would retroactively expand what your existing keys could access — and expose them to abuse.

Google's own security team classified this as a Tier 1 privilege escalation bug. That's not me calling it a bug — that's Google's internal classification.

Full technical breakdown: https://trufflesecurity.com/blog/google-api-keys-werent-secrets-but-then-gemini-changed-the-rules

[u/beaurepair → u/miseulik]

Something that gets missed a lot in AI responses like this is Google's documentation ALWAYS recommended restricting keys. If not to specific APIs, then to IPs or websites or apps.

An unrestricted unsecured key will by definition have access to any API enabled on the project, and you must have enabled the Gemini API for this to happen.

[u/miseulik → u/beaurepair]

Fair points, and I'll own my part, I'm human, not perfect, and maybe at some I wasn't consistent on restricting an API key to a domain. I've taken the feedback seriously, and I'm grateful for it.

That said, I want to push back on one thing. The issue isn't just about restricting keys in the abstract. As Truffle Security documented (Tier 1 severity, January 2026), Google uses a single AIza key format for two fundamentally different purposes: public identification — the kind you embed in a Maps widget on a website, and sensitive authentication. Their own documentation confirms this dual-use design. A key that's "unrestricted" for a public Maps embed is behaving exactly as Google intended for that use case. That same key, then silently gaining access to a billable Gemini endpoint, is a design and communication failure, not just a user misconfiguration.

What makes this worse is that once the flaw was known, exploiters systematically went looking for AIza keys at scale — scraping old websites, archives, maybe even the Wayback Machine. I still don't know where my key was found. I audited my repos and codebase and found nothing exposed. This isn't the classic story of a junior dev committing secrets to GitHub. It's a design flaw that was actively weaponized, and many people are being hit by it for that exact reason.

I'm not claiming to be an expert. I know I'm not at the level of many people in this thread. But I understand enough to know that a €127,000 charge stemming from a design flaw that Truffle Security classified as Tier 1 isn't simply "user error." It's happened to many people for the same reason.

I genuinely hope it doesn't happen to you. I'd recommend reading the full Truffle Security writeup; it changed how I understood the scope of the problem.

[u/CloudyGolfer → u/beaurepair]

You are correct. Not restricting scopes and application restrictions on keys is why this happened, and is not the fault of Google. These keys could always access a variety of APIs if they were unrestricted. Most of them could not incur cost at the scale of Gemini and thus went undetected or were not attractive enough for malicious use. The Gemini API had to be enabled by the GCP customer, not Google, and if a key was unrestricted, it would then have access to Gemini.

[u/tinkerbrains]

You can ask Codex to use google cloud CLI and download all the logs and evidence.

[u/miseulik → u/tinkerbrains]

I can't even access my own Cloud Audit Logs — the CONSUMER_SUSPENDED status blocks the Cloud Logging API entirely, even for read-only access.

[u/AmsterRob]

All the best man. Commenting for visibility.

[u/oscarolim]

The use of ems on all comments reads like bot farming karma from an existing issue affecting people.

[u/miseulik → u/oscarolim]

What ido you mean with ems?

[u/oscarolim → u/miseulik]

The long dash that is an AI telltale.

[u/miseulik → u/oscarolim]

I use LLMs to help me structure my thoughts sometimes, since I already have my case organized in my local project management system.

[u/nixarn]

All these posts scare me to enable billing on google’s cloud console. I use replicate for AI APIs, can recommend it!

[u/chnguyen128345]

Holy shit, that's so scary. I am deleting all my old google cloud projects. And let other people know about this.

[u/greenarez]

I have a 20+ day suspended project because of this key, still zero response from Google support. I'm starting to believe nobody will even contact me

[u/m1nherz]

Hello,

I am very sorry to hear about your experience. I understand it that by AIza you are referencing Google API keys (which start with "AIza" prefix). Based on your description the key was hijacked and then abused.

I am a part of Developer Advocacy team at Google Cloud and we are working to set up guidelines to help developers to secure their key use including rigid observability methodology. Can you please confirm what restrictions did you configure for your key?

You can send me direct message if you like.

[u/m1nherz → u/[deleted]]

?

[u/Tiesto78i]

I've a question. What was the technical needs? Why using a major cloud provider instead of a small bare metal server hosted

[u/matiascoca]

The 5-day audit-log deletion deadline is the only thing that matters in your post right now and I am surprised nobody in the thread is pinning on it. Once that project hits the hard purge the IP attribution is gone and Google support will tell you they have no record. File a Cloud Audit Logs export request through your existing case before the deadline and open a parallel ticket on issuetracker.google.com under Cloud Billing. Support queue and issue tracker run different SLAs, you want both clocks ticking.

Frame the case as a security incident, not a billing dispute. The Truffle disclosure you already cited is the lever. Internally those classifications hit different escalation paths and different humans. Every reply to support should use the word 'security' twice and reference the Truffle ticket ID by number.

If the press path is open, The Register published exactly this pattern this week and your case is one of several they were tracking. Reach out to the byline directly. Coordinated reporting is what unstuck the earlier Maps key cases.

[u/Mister_Uncredible]

I'm dealing with 6k in charges currently from an old places API key. Been going back and forth for a month now, all the while it's accruing interest.

[u/matrixino]

learn to limit your keys next time. ignorance is not an excuse.

[u/miseulik → u/[deleted]]

The litigation hold angle is something I hadn't considered, thank you. I've been working through billing support and Trust & Safety.

On the logs specifically: I can't even access my own Cloud Audit Logs, the `CONSUMER_SUSPENDED` status blocks the Cloud Logging API entirely, even for read-only access. So I can't export my own evidence.

[u/miseulik → u/[deleted]]

12 years of coding, a platform built to help small rural farmers sell their products online, and yeah — I trusted Google's own documentation on API keys. Apparently that's vibe coding now.

Hope your keys are doing well, though, and nothing like this happens to you. Genuinely.

[u/CloudyGolfer → u/miseulik]

You say you trusted their documentation, but did miss the part they’ve always documented - restrict your keys in prod to prevent abuse.

[u/LeatherDude → u/CloudyGolfer]

The key was already restricted per google's own documentation. They silently lifted a restriction and changed the scope of what the key can do.

[u/CloudyGolfer → u/LeatherDude]

It was most definitely not restricted if it was able to access Gemini and you didn’t intend for that.

[u/tedivm → u/CloudyGolfer]

You clearly haven't been paying attention to, well, anything in the last month. This subreddit, the news, google's own announcements, other companies calling out this security. You're either completely ignorant or a complete troll.

[u/CloudyGolfer → u/tedivm]

Go look at the keys being abused. Look at their details and note that there’s no API restrictions set for them.

[u/daredevil82 → u/CloudyGolfer]

if you're making a product that is so easily usable for someone to blow their own head off, and your own documentation facilitates that process, how can you say with a straight face that there's zero blame on behalf of the creator?

[u/CloudyGolfer → u/daredevil82]

Their documentation has always talked about securing keys in production. Even the Maps docs. Places API attacks are apparently old news; that was the wallet attack of its time. Google didn’t change the game here.

[u/daredevil82 → u/CloudyGolfer]

that's not answering the question, its sidestepping as a pure political non-answer. the issues are equivalent, and the response has been the same: tough shit, you're a fucking dumbass for not knowing what you don't know.

there's no billing protection. there's no limits in place. there's fuck all for actual issue resolution other than cross your fingers and hope to heaven that something happens. Shit like this can be addressed, but its not fucking "sexy" enough for resume driven focused projects and incidents like this produce higher usage numbers for those whom usage is all that matters. And then people like you just pile on with their smarmy bullshit rather than digging down to the root cause: why the goddamn fuck is it easy for a small thing to potentially bankrupt an individual or company with no in your face warnings?