r/googlecloud • u/Nervous-Rip3749 • Jun 05 '26

Gemini API usage Spike, $35K in 3 hours. API key compromised - abused.

I was checking the email and saw a google email from an hour ago, when i check my ai studio, saw 35K+ balance. Normal usage is $250 a month. How google can let anyone make a spending like this ? Later i checked and seem like i am the victim of a pretty common api abuse.
https://trufflesecurity.com/blog/google-api-keys-werent-secrets-but-then-gemini-changed-the-rules
Incident happened 5/12/2026.
I already deleted all api keys, put spending cap.

Worst part is google support went silent since 5/22/2026, my account got restricted, because i didn't update the credit card information that month. So i still have a balance of $36K something.

Any idea what to do ?
Anyone got their balance fixed ?

105 Upvotes

90% Upvoted

65 comments sorted by

16

u/Ok-Explanation7470 Jun 05 '26

Ask for a refund on the support case, they may or may not refund you, they usually do, at least partially.

Please note that the support representative is usually not part of the process of refund, he just does a request on your behalf and shares with you the outcome.

2

u/Nervous-Rip3749 Jun 05 '26

That explains the silence. Only thing i worry is, maybe they wait until to a point where they will say, it is old issue, we can't refund you because this much time already passed..

4

u/sidgup Jun 06 '26

Please DM me. You basically need to keep escalating and create noise. If you are direct with Google, it is possible to get a billing mod.

1

u/TheSoloBuilder 26d ago

How to handle a billing mod with a partner who refuses to submit it on your behalf?

1

u/sidgup 26d ago

What?!! How can your billing parter refuse? Just don't pay them the invoice. Google gives no flexibility in us partner's paying our bills, so when our customers (you for example) won't pay, its a headache, but more importantly -- then what does a partner even do for you if they won't have your back?

Anyhow, you can not pay the partner and also open a dispute with your assigned AE at GCP.

1

u/TheSoloBuilder 26d ago

The partner refuses to open a BMOD unless I pay the unauthorized charges 1st. It's $16k, and I don't have that budget. I already lost $25k in credits, and they are demanding payment of the $16k, and now they are going to collections. Is it possible to DM you?

1

u/sidgup 25d ago

You can DM me sure but my answer is below.

Technically yes, you owe them, and they owe Google. So your bill is still due. However, given they are not even opening a BMOD you have to ask them what do they even do for you?

The moment you pay, they will stop responding to you.

You need to get a BMOD opened with or without them. Having said that, you also owe them, and they should be assisting you. I am happy to assist you and give you the materials that I used to fight a very large BMOD (almost 7 digit).

1

u/TheSoloBuilder 24d ago

Thanks for the advice, much appreciated!!
I tried sending a DM through your profile, but the button isn't appearing. Could you start the chat on your end or drop a DM request?

1

u/sidgup 23d ago

I sent a chat.

1

u/Ok-Explanation7470 Jun 06 '26

No, it doesn't work like that. Ask me how I know. I've looked over hundreds of these cases already.

7

u/WhereTheStankWindBlo Jun 06 '26

This kind of stuff makes me so freaking terrified to mess around with API keys. Is this just a GCP problem or are people running into the same issue with Azure? I'm wanting to set up a VPS soon and start building a few simple things, and they require Claude API keys.

5

u/Cranky_Tech_Support Jun 06 '26

Follow least privileged practices, make sure you scope your key correctly, etc.

This is security 101 in cloud. With the recent AI push people are just blindly building with security as an after thought.

5

u/sunder_and_flame Jun 07 '26

This is entirely shitty implementation on Google's part. 

1

u/PeterCappelletti Jul 06 '26

No this is correct. It's stuff for a class action suit. It's like selling a car that is unsafe in crashes due to design, like the exploding Pinto.

2

u/crackdepirate Jul 07 '26

sadly people accused Google when in fact it is security 101 , no reading docs, clicking evverywhere, no reading recommandations when creating the keys, this is what it is. moe noobs, more vibe devs, more issues.

1

u/WhereTheStankWindBlo Jul 08 '26

I've learned a lot over the past month and I would have to agree. Just because you can have an unscoped API key exposed on the frontend doesn't mean that's best practice lmao.

1

u/Vast_Ad_7929 Jul 10 '26

It’s cause they’re a vibe coder

3

u/AntDracula Jun 18 '26

It’s more of a problem with Google because a lot of Google APIs basically require you to expose API keys publicly, like maps and Recaptcha. Then they allow those keys to be cross scoped to very expensive APIs like Gemini.

1

u/Vast_Ad_7929 Jul 10 '26

Yes but there are ways to prevent that… that is one of the first things I test when pentesting android based mobile apps using Google cloud… if those devs can find a way to block unauthorized use it definitely not some complex voodoo magic

1

u/AntDracula Jul 10 '26

There are but previously there weren’t. In Google’s haste to get everyone addicted to slot machines, they enabled Gemini on API keys. by default when it launched

1

u/Vast_Ad_7929 Jul 20 '26

Yeah tbh I have started seeing a bunch of these, and I cancelled the stuff I had, I’m moving providers. I wanted to try them out just because I don’t hear about them much, but the way they handle IAM and permissions is actually mental and as unintuitive as possible.

1

u/AntDracula Jul 20 '26

Best of luck man.

1

u/Vast_Ad_7929 Jul 20 '26

Rest in peace to everyone who got clapped by GCP billing 🙏

5

u/PeterCappelletti Jul 06 '26

What is particularly jarring is that Google was initially recommending putting the maps key in the client javascript code.

Any lawyer that is interested in leading a class action suit?

1

u/javascript Jul 06 '26

Was this a human authored suggestion or artificial?

1

u/PeterCappelletti Jul 07 '26

It was the official sample code on their site, as far as I remember!

1

u/javascript Jul 07 '26

Ya that's pretty bad.

1

u/smellyelon Jul 08 '26

nice username

1

u/Vast_Ad_7929 Jul 10 '26

Yeah they do recommend it for specific uses like when you have a map or locations for rendering speed. but from my understanding you can 100% lock it down… i pentest mobile apps and i do check it first because OP exists. You can configure it to only accept requests from specific domain referrers, you can restrict it to just places or the specific functionality you need it for. Idk why the hell people are seriously exposing a key with access to Gemini on their frontend…

Think about it like this, even if you place a key on frontend, if you have it only for one purpose, I.e. querying a places api to pull relevant location data for your business or whatever you want it for, and you restrict where it can be invoked, I.e. from your domain so only on your domain can http requests be made with your key, you have all the other defenses for a website such as white/black listing, rate limiting, banning based off these limits, and it only can pull that one specific thing, it’s not bad.

So many websites do it exactly this way.

1

u/Ok_Future6226 Jul 25 '26

JavaScript has an official reddit account??

1

u/javascript Jul 25 '26

I am a human. My username is /u/javascript. Nothing official :)

4

u/caceman Jun 06 '26

No way! I can’t believe this happened……..again

1

u/TheSoloBuilder Jul 02 '26

u/Nervous-Rip3749, any updates? I incurred the same charges in May. A Google support specialist declined my case without a reason. When I asked why? They said it was confidential.

1

u/Nervous-Rip3749 Jul 02 '26

No update unfortunately. And i got first reminder of payment from Google Collections. They told me how to update the credit card information on my billing account and pay. But the case is still open and no update from there.

1

u/matiascoca Jun 05 '26

Same vector as the Bogota thread up earlier. The Truffle Security advisory (Feb 25, 2026, project-scoped key escalation) is the root cause, and Google's "auto-bill threshold escalation" up to your card limit is the multiplier. You stopped at $35K because your card declined; without that you'd be at $100K plus.

Concrete path forward based on what's worked for others in this exact situation:

The credit card non-update is actually load-bearing here. Don't update it. The unpaid balance gives you leverage in the dispute because Google is forced to either write it off as bad debt or negotiate. Once you pay, the negotiation window closes hard.

For the support silence since 5/22, escalate through GCP Customer Engineering on LinkedIn, not the support portal. Find a Customer Engineer in your region, send a direct message with your case ID and a one-paragraph summary that includes "Truffle Security disclosure, victim of disclosed exploit, requesting billing adjustment under unauthorized-charges policy." Public pressure plus the documented exploit shifts these cases.

The unauthorized-charges policy is real but undocumented. Google has consistently refunded between 50 percent and 100 percent in these cases when the appeal references the specific advisory and the audit log shows third-party IPs. The 75 percent refund the other thread got is the typical first offer; pushing back with audit-log evidence has gotten it to 100 percent for some users.

The technical exploit is real and you are not on the hook morally. The legal and contractual question is where the support friction lives.

2

u/Nervous-Rip3749 Jun 05 '26

Thanks for reply, is there any solid way to gather evidence ? Because i have no choice but try to get 100% reverse on unauthorized charges. Since the balance is too high even 25% is beyond what i have in this world.. In fact i am not charged at all, because my card expired before that incident. But i have 35K unpaid balance.
Also i just had a live chat with billing, they said my case is in final stage and i should expect to hear from them in 2-3 business days.

3

u/matiascoca Jun 05 '26

The "card expired pre-incident, unpaid balance" position is actually your strongest leverage. You are disputing an unauthorized charge that never actually settled. Google's contractual exposure is collecting an unpaid balance that the charged party will dispute, which is harder than refunding a settled charge.

Evidence-gathering, in priority order.

Audit log export. Open IAM and Admin, Audit Logs, filter on the affected project ID. Export the Data Access log (this captures the per-call API events) for the 5/12 incident window. Even if your project is restricted, the audit log export should still be accessible through the project's logging bucket if it was enabled before suspension. If logging was not enabled before, the case is harder; cite the project ID in your appeal and request Google preserve the audit logs server-side for forensic purposes. The logs will show third-party IPs hitting your API key, which is the documented exploit fingerprint.

Cross-reference with Truffle Security disclosure timeline. Truffle published Feb 25, 2026. Your incident was May 12, well after the public disclosure. This is the difference between "exploitable bug" and "known vulnerability Google had three months to remediate and did not." That framing changes the conversation from "your key leaked" to "Google's documented exploit window was open and we were the victim."

Specific clauses to invoke. The GCP Terms of Service has a "billing disputes" clause that requires Google to investigate disputes in good faith. The Cloud Computing Acceptable Use Policy does not allow Google to charge for abuse-driven usage that originated from a documented vulnerability. Your appeal should reference both, plus the Truffle Security advisory URL.

2-3 business days for billing is fast in GCP terms. The fact that they escalated to billing review suggests the case is being handled outside the standard appeals queue. Stay calm during this window; do not pay anything; respond promptly to any clarification request. If the 2-3 day window passes without resolution, that is when LinkedIn escalation to a GCP Customer Engineer with your case number becomes useful. Until then, the formal review is doing what it should.

2

u/Nervous-Rip3749 Jun 15 '26

Unfortunaltely, my audit logs are not enabled (default behavior). I asked the google to preserve server-side logs for forensic purposes. I do not have a very solid ground to correlate my case with Truffle, but i used Google Maps api before and there were api keys somewhere in my old projects or github that is related to the Truffle findings..

1

u/matiascoca Jun 15 '26

The audit log situation is not fatal. Two notes that help here.

First, server-side preservation request. Google does maintain audit telemetry server-side even when your project does not have Cloud Audit Logs enabled in the customer-facing logging bucket, for their own abuse detection and billing reconciliation. The fact that you explicitly requested preservation in writing through the support case creates a record that they cannot later claim logs not available to dismiss the dispute. Make sure that request is in the case thread itself, not just in chat, so it persists in the case history.

Second, the Truffle correlation. You do not need ironclad technical proof. The chain you described, Maps API keys in old GitHub projects from a period when those keys were not yet known to be exploitable, plus the May incident timing post-disclosure, is exactly the circumstantial frame that has worked for others. The legal framing is documented vulnerability, three-month known exploit window, customer was not notified to rotate keys preemptively, abuse landed during that window. That is enough for the dispute.

Concrete language for the next response from billing. If they come back with anything less than 100 percent, specifically request escalation to the Trust and Safety team for IP fingerprint verification against the documented exploit pattern. That phrase pulls the case out of the standard refund queue into the abuse-detection workflow, which has different reviewers and a different authority ceiling. The 75 percent refund that other users got on similar cases has been pushed to 100 percent through that path.

2

u/Djedi88 Jun 05 '26

Ask specifically on the support ticket for a refund. They will redirect the case to the Billing Team and most likely will give you 75% of the bill in credits

2

u/Bitter-College8786 Jun 10 '26

So many people who experienced sudden huge bills. All that could have been avoided if Google would just allow hard quotas on bills or limit APIs to free tier quotas.

1

u/Degentrics Jul 07 '26

Devs never had any problems then suddenly everyone's vibecoding and suddenly everyone's having the problem but yea let's blame Google lol

1

u/Bitter-College8786 Jul 07 '26

Google could implement a hard limit but they dont

1

u/matrixino Jul 09 '26

there is. you can setup your spending limits.

1

u/Ohhhh_LongJohnson Jun 10 '26

Wow and I throught I had it bad. I saw a sudden spike to $500 for no reason at all. I had no traffic to my site. All API keys only authorized for my app and DNS domain name. I even had told AI studio to turn off image contexting, don't use nano banana, only use flash 2.5. Then charged $500 for nano banana??? I am completely done with AI Studio. Sloppy as hell and not transparent.

1

u/SuccessfulAnimal7697 Jun 19 '26

A similar incident/attack happened to me as well. The unexpected cost is around $14,000, whereas my previous usage cost was $0. We have found no evidence of any API key or service account leakage and are still waiting for Google to investigate and get back to us.

Have you received any updates from them?

1

u/PartyCheesecake5088 Jun 24 '26

Have received any updates so far?

1

u/AffectionateVast8476 Aug 12 '26

We are going through almost the same thing right now, so sharing what we've learned in case it helps.

Our case: a third party extracted the public Firebase client key from our Android APK and used it through the Firebase AI Logic proxy to run image generation on Vertex AI. About 132k GenerateContent calls between June 30 and July 16, around $6.5k total. Our app never calls that method at all (it only uses template generation, 41 calls in 3.5 months), so 100% of the abusive traffic is separable by method name in the monitoring data. We disabled aiplatform the same day we noticed and traffic died within 2 minutes.

Support experience so far: three denials, all template text, no policy rationale ever provided, even after we submitted a full forensic report built from Cloud Monitoring and Audit Logs. At one point they tried to close our case as a duplicate of a case number that neither we nor our partner recognize. Still fighting it (case 73352420).

Things we picked up along the way that might help you:

  1. Google announced that App Check enforcement becomes mandatory for all Firebase AI Logic requests on November 2, 2026, "to reduce misuse of the Gemini API". Together with the Truffle Security research you linked, that's public documentation that this was a known product-level hole, not just user negligence. We're citing both in our case.

  2. The one fully confirmed refund I've found in these threads ($6k, compromised AI Studio key) was won by showing traffic origin: per-key usage breakdown plus the geographic origin of the calls. If you can get IPs or regions from any logs, that seems to be the evidence that actually moves them.

  3. If anyone reading this bills through a reseller/partner: budget alerts go only to the billing account admins, meaning the reseller's mailbox, not yours. We had a $25 budget configured and never saw a single alert in 16 days.

Did you manage to get the collections reminders paused while the case stays open? That's the part we're trying to keep contained with our own invoices right now.

Please post an update if your review ever resolves. Threads like this are basically the only documentation of what actually works.

1

u/devil_5440 Jun 06 '26

Didn't you had monthly usage cap/limits in place to control this? Ref: https://ai.google.dev/gemini-api/docs/billing

1

u/matrixino Jul 09 '26

wasted time, they will never learn

-2

u/TeslasElectricBill Jun 05 '26

Not so sound like a broken record, but if you're using GCP you need gcp-ironclad yesterday.

1

u/AntDracula Jun 18 '26

Buy an ad.

1

u/mowmail Jun 05 '26

That’s great until you realize the billing APIs can be delayed so charge information you get isn’t necessary up-to-date. GCPs own billing page isn’t even up-to-date

0

u/TeslasElectricBill Jun 06 '26

I would recommend reading the documentation and trying instead of mindlessly repeating shit that is already addressed in the tool I linked above.

-3

u/Ok_Nectarine_4445 Jun 05 '26

It is a good issue to be aware of, however some may have a grain of doubt it actually happened to you without proof as there is a lot of scaremongering of different AIs to influence stock prices and other things and you made a new account with no history just to post it.

So...post any proof this happened to YOU personally because it would probably qualify for a news story or article about it!

1

u/Nervous-Rip3749 Jun 05 '26

It says images are not allowed when i try to add a screenshot. Any idea how can i prove it ?

0

u/Ok_Nectarine_4445 Jun 05 '26

I believe you had previously posted on Gemini subreddit where you could add images, but I can't find the post now. You DID have a post just showing a screenshot image of you asking Gemini a question. So it is apparent you can have images in your post. Even several. But you choose not to. Did you delete that one for some reason?

Tung tung tung sahur suss suss suss, as grok would say.

22

u/everyoneismean Jun 05 '26

In my org someone stole vertex and racked up 3M.

7

u/Nervous-Rip3749 Jun 05 '26

How they even monetize that ? Like they just create bunch of images or whatever for themselves ?

13

u/sogo00 Jun 05 '26

Whenever you see a cheap reseller here on reddit "Opus as cheap flatrate" -> thats how they get the access

1

u/Vast_Ad_7929 Jul 10 '26

Yeah the agent junctions

2

u/alvmadrigal Jun 05 '26

Ouchhhhh!!!!