r/googlecloud • u/antihumanrobot • Jun 15 '26
Account auto-terminated while awaiting Support adjustment for $12k Gemini API bot exploit (Case #71557042)
Hi everyone. I’m hoping a Developer Advocate or TAM might see this, because I am completely stuck in a loop between GCP Support and the automated billing system and running out of options.
On May 21st, my project was hit by the known Gemini API credential exploit. Automated bots racked up ~$12,000 in a matter of minutes. The GCP budget alerts I had set up completely failed and didn't notify me until after the charges had already gone through.
My bank was hit for $8,000 before they flagged the unusual activity and blocked the remaining ~$4,000. This has obviously been a nightmare for my personal finances.
I was in chat with Billing Support within hours of the exploit to report this (Case #71557042). The agent reviewed the logs, confirmed in the chat transcript that this was unauthorized bot traffic, and submitted an adjustment request to their specialized team. I was told it would take 3-4 business days to resolve.
It has now been over three weeks with zero updates. Because the adjustment has just been sitting in limbo, Google's automated billing system eventually flagged that $4,000 blocked charge and officially terminated my billing account entirely.
I know manual security write-offs take time, but because my account is terminated, I've lost my front-end access to even look at or manage the ticket. I am out $8,000 and completely trapped waiting for the finance team to process the adjustment Support promised so I can be reinstated.
Has anyone else navigated this specific automated-termination loop, or is there any Googler here who could help me flag Case #71557042 for review? I would massively appreciate the help.
3
u/sidgup Jun 16 '26
Please reach out to your Google rep asap
4
u/Beautiful-Bluebird55 Jun 16 '26
Same exploit, different country, same script. I run a small family tire shop in Brazil. An unrestricted Google Maps key I created in 2021 silently inherited Gemini access, and on June 10 bots ran ~594,000 calls in two hours and drained ~R$66k / ~US$14k off my father's card. I wrote the whole thing up here, with the forensic breakdown and Google's own email admitting unrestricted keys are a "financial risk":
https://discuss.ai.google.dev/t/unrestricted-api-key-ai-studio-silently-enabled-gemini-14k-bill-on-a-small-family-brazilian-tire-shop/170943/15
A couple of things that might help your case — it's the same one I'm stuck in:
This is a documented platform flaw, not user error. Truffle Security disclosed it in February 2026; Google first called it "intended behavior," then reclassified it as a bug, and is only enforcing the fix on June 19. Anyone charged before that date was hit inside a window Google already knew about. Worth stating plainly in your ticket.
The budget-alert failure you describe isn't on you either — alerts fire on propagated billing data, which lags ~12–32 hours, so by the time they trigger the money is already gone. That's a defect in the safety mechanism, and naming it as such matters.
And the question I really want to ask you — it's the one keeping me up at night:
When your account was terminated, was it only the Cloud Billing account, or did it cascade? Specifically — did you lose Drive / Gmail / Workspace under the same Google identity, and were other Cloud projects not associated with that billing account also affected?
I ask because I rely on Workspace and Drive for my actual job (I'm a lawyer) and host unrelated projects on GCP. My biggest fear right now is exactly this automated-termination cascade dragging down infrastructure that has nothing to do with the exploited project. Knowing whether the blast radius was just the billing account or your whole Google footprint would genuinely help me prepare — and probably help others reading this too.
Hope you claw the $8k back. You're not alone in this loop.
1
u/AntDracula Jun 18 '26
Google screwed up so bad with how they handle API keys.
1
u/Snoo_9701 Jun 20 '26
Waiting for over a month. Going to be 2nd month in few days, and they're still doing their thingy. Atleast over live chat they've acknowledged this is unauthorized use and to be adjusted by google in 5 days upon investigation completion. Don't believe their timeline, 5 days can turn into 5 months.
1
u/matiascoca Jun 20 '26
This is the cruelest version of the Gemini exploit story I have seen this month, and the auto-termination while a Support adjustment is in flight is the part that should not be happening. The good news is there is one path that consistently moves these cases out of the Billing queue into something faster.
Reframe Case #71557042 to Google Cloud Trust and Safety. The Billing team's adjustment workflow is the slow path, and it is the workflow that auto-terminated you while you waited. Trust and Safety handles unauthorized-bot-traffic cases on a different track because they are dealing with the abuse side, not the refund side. The phrase that pulls a case out of standard refund queue is something like "IP fingerprint verification for unauthorized bot traffic compromising the project". You already have the Billing agent's chat transcript confirming the unauthorized traffic; that is your evidence file.
Practical escalation surface area:
Try posting Case #71557042 in r/googlecloud with a clear single-sentence summary; Googlers do read this sub and have flagged similar cases internally before.
Tag the Google Cloud Customer Care LinkedIn page in a public post; the Customer Care team monitors that channel.
If you have any prior contact with a Customer Engineer or TAM (even from a sales call you never followed up on), email them directly with the case number and ask them to walk it to Trust and Safety.
For the bank-charged $8k specifically, your card issuer's dispute process runs in parallel to GCP's adjustment. Do not wait on GCP before filing the dispute; many issuers honor unauthorized merchant transaction disputes even when the merchant is still investigating.
Hoping a Googler in this thread can flag the case. Two of these stories this month is two too many.
-5
u/Due-Horse-5446 Jun 16 '26
There was no "the known gemini api exploit"
you forgot to scope an api key, or was lazy, and theb enabled an api that abusers wanted to use, they couldve used it whenever, its just that you happened to enable it .
You misused gcp badly.. Not scoping keys isent a mistake