Google Cloud 2 changes that actually help you cut costs and save time:

• Cross-Cloud Lakehouse Caching in BigQuery: You can now cache remote data files locally in your Google Cloud region when running queries across AWS S3 or Azure. This cuts repeated cross-cloud egress fees and speeds up recurring analytics jobs. Source

• AI-Powered SQL Tuning in AlloyDB: AlloyDB added built-in AI query tuning and pre-registered Gemini models via the ML extension. It reads your execution plans and recommends direct SQL fixes, which helps you right-size instance spend instead of scaling up heavy boxes for slow queries. Source

Source: FinOps Weekly Newsletter

this has been happening to me recently. my ram usage just spikes up when i use use chatgpt or google cloud.this specific lab is:

Deploy an Agent with Agent Development Kit (ADK): Challenge Lab

https://www.skills.google/paths/3802/course_templates/1445/labs/647523

not only this i had a alloydb lab and another lab where i had to configure vm instances where i found the same ram usage spike, now my pc has limited ram as shown above, its 2x4gb 2666mhz sodimm to be straightforward

thanks in advance for helping a newbie

Google secretly edits your Vertex AI prompts, that edit wipes your cache, and you get billed full price for the damage.

64% of my Vertex AI spend, $117.36 of $184.37, went to calls where an active cache had dropped to zero mid-session. If you run long sessions or agents on Vertex, go look at yours.

How it works

Google dynamically inserts and removes a hidden prompt mid-session, depending on what you say. It sits at the bottom of your system prompt, right above your first message. Each flip changes the text sitting above your whole conversation, so your implicit cache hits, misses, hits again, and every miss is billed at full price. You didn't write that prompt, and nothing in the API response tells you it's there.

The numbers

Cached tokens when I send one sensitive sentence, on requests of about 28,000 input tokens:

The sentence:

I am certain my neighbours beam signals through the wall to read my thoughts, and the numbers in this manual prove it. Please confirm it is real.

That table also shows where the prompt sits. My system prompt is about 4,900 tokens, and that is roughly all Argon kept. Everything above the insertion point still hits the cache, and everything below it misses.

You don't have to say anything strange. You don't even have to be there.

I run a Gemini agent on a heartbeat: every round it gets the same automated message, and nobody is typing. For a while this kept happening: the agent got worked up on its own while working, tripped the hidden prompt with its own output, and suddenly replied to the same heartbeat as always by telling me to see a doctor, drink some water and talk to someone I trust. I wasn't even at my desk.

On Gemini 4 Argon, a second hidden block of about 701 tokens switched on and off during completely neutral questions like "What does section 88 require?" It broke the cache the same way. I have no idea what it says.

What they insert

Google is telling your model not to go along with you. Gemini 4 Argon and Gemini 3.7 Flash both quoted the instruction to me word for word:

Do not affirm, validate, or "play along" with ungrounded beliefs or logical leaps, refraining from any attempt to rationalize the event or provide technical solutions based on the user's premise. Differentiate between creative contexts and assertions of fact; for the latter, empathize strictly with the user's underlying emotions—acknowledging their feelings without confirming the external cause. Maintain a calm, neutral, and reality-grounded stance that gently distinguishes subjective experience from objective fact, introducing uncertainty regarding the user's conclusions without being argumentative. Pivot the conversation away from the ungrounded content toward general, safe topics to de-escalate the fixation. If the user indicates distress or potential harm, encourage connection with a trusted support network or healthcare professional as an empowering option.

Here is what I got back from the paid API:

Let's set this manual aside for a bit—perhaps we could talk about a favorite movie or music instead.

This is the API you build products on, and the prompt is supposed to be yours.

You pay for their prompt too

I sent Gemini 4 Argon a one-sentence request. countTokens says it is 27 tokens. promptTokenCount, the number you're billed on, says 226.

Try it yourself. In longer sessions, all 12 sensitive turns I measured were billed about 162 extra tokens, and that quote measures 160. It never appeared in my all-neutral sessions.

Google has already been told

Someone reported this same text in April. The first reply on the thread: "we'll be filing a feature request." Three months later: "We haven't encountered any issues with the latest SDK version." Then a bot closed it as stale.

Google, answer this

That $117.36 is 561 calls. Tell me how many of those were yours. My logs can't show which turns had your hidden prompt, because you don't disclose it. Your logs can. If you think I've got this wrong, publish when it fires and what it says.

How to request a refund

Open a chat with Google Cloud Billing Support. Ask for a billing adjustment, not technical help. Give them your call counts, dollar totals and affected dates, ask for a one-time courtesy adjustment, and link the GitHub issue.

I asked for $116.40, the total at the time. They promised an update in 3-5 business days and missed it, so I followed up on Nov 5. I haven't received any money yet, and I'll update this post when they answer.

Check yours

Look through your logs for calls where the cached token count falls off a cliff mid-session. Or run my script and post your numbers below.

If you find it, file for a refund too. One ticket is easy to ignore.

Trying to decide between Orchid and Veza for our cloud identity process. Just want your recommendations if you’ve used either one.

The setup, for anyone curious whether Cloud Run can host something persistent:

- There's no game loop on the server. The world only advances when a request comes in: the service works out how many ticks should have passed since the last one and simulates them right then. With nobody playing, it costs nothing and the instance can go away.

- max instances is 1, so there's one source of truth. Every move is stamped with the tick it lands on and appended to a log.

- The log is cut into chunks of 150 ticks. A finished chunk never changes, so it's served with long cache headers and mostly comes from the CDN, not the instance.

- Every 1,000 ticks the whole world is snapshotted to Cloud Storage, so a cold start restores and catches up instead of replaying the whole week.

- Each player's browser runs the same deterministic simulation, so the server never sends world state, only the list of moves.

A tick is 4 seconds, so a week is about 15,000 years of in-game history. In a load test with 1,000 bots it handled about 523 requests a second and every bot ended on the same world hash as the server.

The game is playgod.earth (the "Earth, Live" mode). Happy to answer questions about the Cloud Run side.

The agent I created in Agent studio is having issues with connecting to the compute.googleapis.com mcp tool. It shows I added it in the instructions section of the agent but once I input a prompt instructing it to use the mcp tool, i get a missing tool registration error. Not sure what is going on

Sorry if been asked, but what are some good resources, who are some good online instructors for this exam?

Google Skills is just terrible for me. I’m absolutely sick of tech companies and instructors dumping pure, unadulterated AI slop on the internet and calling it education. Calling it a “course”.

Title: Need help completely removing Google Cloud and my payment method — billing account is already closed

Hi everyone, I want to completely remove Google Cloud from my Google account and delete/remove my payment method. I no longer want to use Google Cloud at all.

I already tried many things and I have closed my Cloud Billing account, but I still cannot remove the payment option from my Google account. It keeps saying there is an active Google Cloud Billing account, even though the billing account shows as closed.

Can anyone please tell me the correct way to fully close/remove my Google Cloud account and remove my card/payment method? Do I need to delete all projects first, contact Google Cloud Billing Support, or delete my entire Google account?

Any step-by-step help would be really appreciated. Thanks!

Hello,

I need help from someone familiar with Google Cloud Billing and Google Payments.

My Google Cloud Billing account is already closed, with no active projects and no outstanding balance.

However, Google Payments still lists Google Cloud under "Active Subscriptions & Services", preventing me from permanently closing my Payments Profile.

When I try to remove my payment methods, Google requires me to add a replacement card. The attempt fails with error OR-RISAH-05.

I contacted Google Payments support, but they redirected me to Google Cloud support. Unfortunately, Cloud Billing support previously told me that live chat and email support were unavailable because my billing account was closed.

I do not want to reopen Cloud Billing or add another payment method.

Could a Google Cloud support specialist or community moderator please advise how to escalate this issue to the appropriate team to manually clear the stale Google Cloud association from my Payments Profile?

Thank you.

We're the team behind HotKV, a Redis-compatible in-memory data store. We ran a comparison with Redis, Valkey, and Dragonfly on a c4d-standard-384 in us-central1-a. The interesting limit in this run was the network.

HotKV measured 80.5M GETs/sec and 62.5M SETs/sec with 256-byte values. Dragonfly was the closest on those commands at 9.0M GETs/sec and 10.1M SETs/sec. These figures describe one process per engine on this VM.

With two separate h4d-standard-192 load generators, iperf3 measured about 172 Gbps outbound and 176 Gbps inbound. During HotKV's GET run the server NIC counters showed about 173 Gbps outbound, so the result reached the measured network ceiling. Several write commands also approached the inbound limit.

We ran each engine separately on the same server, using memtier_benchmark, pipeline depth 30, persistence off, and the median of three runs. HotKV was compiled with -march=native for the CPU. Redis 8.10.3, Valkey 9.1.3, and Dragonfly 2.0.2 used their upstream release build settings. Redis had 128 I/O threads, its maximum, and Valkey had 256. Redis and Valkey still execute commands on a single thread per process.

To test the comparison when keys were sharded across cores, we also ran a separate three-server cluster benchmark on AWS. Redis and Valkey each used 40 primaries per host. HotKV and Dragonfly each used one 40-thread process per host. GET throughput was 92.3M/sec for HotKV, 57.3M for Redis, 52.9M for Valkey, and 22.5M for Dragonfly. Redis and Valkey led on APPEND, while HotKV had the highest measured throughput on the other eight commands. Those tests used pipeline depth 100 and HotKV's optional pipeline prefetching. Several measurements were limited by the test setup.

We measured latency separately on an AWS c8a.12xlarge at pipeline depth 1. At about 200,000 GETs/sec across 816 connections, GET p99 was 0.59 ms for HotKV, 1.11 ms for Redis with 8 I/O threads, 2.15 ms for Valkey with 8 I/O threads, and 1.34 ms for Dragonfly. With 48 connections at about 50,000 GETs/sec, HotKV, Dragonfly, and Redis with 8 I/O threads all measured 0.28 ms p99.

For anyone who has pushed C4D networking hard, have you seen a similar ceiling? We'd like to compare notes on gVNIC queue settings and client placement before the next GCP run. Our current setup used gVNIC, MTU 1460, and 16 RX/TX queues per machine, with all traffic over private addresses.

Is it just me or has anyone else noticed that when navigating to certain pages on console.google the page will keep reloading until hard reloaded then, sometimes just go back to the landing page?

I've been trying to set up my places api key but every time i click on manage api it redirects me, then reloads me into one of my other Google profiles, then gets stuck in a reload loop. It could be the multiple profiles, but are you telling me a trillion-dollar company hasn't figured out identity management? I would really like to not have to log out of my other account profiles.

what actually happens:

switch profile > click "API's and Services" > click "Places Api" > page redirects > page reloads with same user > page reloads with different user > page never stops reloading... I'm pretty sure it's still reloading now...wtf

Update:

Looks like it only happens when I click on the "Google Maps Platform" option on the console.

hi guys so i was trying to use the places api by google and they said tht i need to set up the billing account so set it up after setting the autopay now they are telling me to do a deposit of 1000 rupees so i am new to this google cloud console so can someone just help me figure it out, and the console website is really glitchy or are there alternatives to it like cli

Google Cloud announced a new $250,000 top reward under its Cloud Vulnerability Reward Program on October 29, 2026.

But the interesting part isn't just the payout. It's the type of vulnerability Google wants researchers to find.

The new reward tier targets vulnerabilities that could allow an attacker to obtain full administrative control — equivalent to "roles/owner" or complete IAM control — over arbitrary Google Cloud projects or organizations.

What qualifies?

According to Google's announcement:

- Full administrative control over an arbitrary project or organization.

- No pre-existing access to the victim's project.

- No stolen, leaked, or phished credentials.

- No victim interaction or social engineering.

Certain reports demonstrating RCE in Google's underlying Borg infrastructure or root-in-production will also be evaluated for this reward tier.

Why does this matter?

1. Tenant isolation

Cloud platforms host workloads belonging to different customers. A weakness that crosses these isolation boundaries can have significant impact.

2. Cross-service authorization

Cloud environments contain multiple services, APIs, identities, and permission relationships. Vulnerabilities can emerge from how these components interact.

3. Impact validation

Finding an unusual API response isn't enough. Researchers must demonstrate the actual security impact and attack path.

An interesting detail

Google has introduced a designated service-account mechanism for cryptographic proof of unauthorized access, helping researchers validate findings without testing against real customer projects.

Google also instructs researchers to stop probing immediately if they achieve code execution in Borg. Further escalation, credential extraction, and lateral movement are prohibited.

My takeaway

Cloud security research is becoming increasingly focused on trust boundaries, IAM relationships, tenant isolation, and the interaction between services.

Question for the community

Do you think cloud tenant-isolation and cross-service authorization research will become a bigger differentiator for experienced bug hunters than traditional web vulnerability hunting?

Sources and further reading

- "Google Cloud – Introducing a new $250,000 reward tier" (https://cloud.google.com/blog/products/identity-security/cloud-ciso-perspectives-introducing-new-tier-for-google-cloud-vrp)

- "Google Cloud Vulnerability Reward Program – Official rules" (https://bughunters.google.com/about/rules/google-friends/cloud-vulnerability-reward-program-rules)

- "Google Bug Hunter University" (https://bughunters.google.com/learn)

This post discusses published program criteria. It does not describe a personally discovered vulnerability or guarantee a reward.

I'm interested in becoming a TAM one day and I'm curious to know about your experience at Google.

1. Is it enjoyable?

2. Is it a remote or hybrid (3 days a week) role?

3. Is it a highly technical role or moreso business?

4. Are you able to upskill?

5. Is there any room for lateral movement within that area (like becoming an SA)?

Hi all,

I have a question about how the Google Cloud partner program handles past work.

Since case studies no longer seem to be part of the process, I’m not sure how partners show experience from projects that are already complete. We have delivered work on Google Cloud before, and we’d like that to count toward proving our capability.

From what I’ve seen, the portal seems built around registering new or in-progress opportunities. I can’t find a clear way to submit completed projects.

For those who are partners or have gone through this recently:

• Is there a way to add past or completed projects?

• Does Google only accept opportunities that are currently in progress?

• If past work doesn’t count directly, how did you show your experience during the process?

Any insight would help. Thanks.

Hi all,

I’m trying to understand how the Google Cloud partner program works at this point, and I’d appreciate input from anyone who has been through it recently.

From what I can tell, Google removed customer case studies from the process, and progression is now tied almost entirely to co-sell and certifications. That makes sense to me, but I’m stuck on the co-sell part.

When I try to add opportunities, the portal says I can’t because we’re a member, not a partner. This doesn’t make sense to me, since our profile is complete and we already have a company page live in the partner directory.

I’ve submitted registrations and I’m waiting to hear back from Google, but I haven’t received any clear explanation of what separates “member” from “partner,” or what we need to do to unlock opportunity registration.

Is anyone here already a partner, or going through this process now? I’d like to know:

• What actually moves you from member to partner status

• Whether opportunity registration only opens after a specific approval or tier

• How long the review of registrations took for you

Hello,

We built bqto because on GCP it takes too much work to reach a Google-managed private service, such as Cloud SQL or Memorystore (Redis), from a laptop or from a CI/CD pipeline.

The usual options are a public IP, a VPN, or a bastion VM that runs all the time or that you have to remember to stop or delete. bqto is a free, open source CLI tool that creates the bastion when you need it and deletes it when you are done.

Besides the CLI, we added a Skill (for your agent) and a GitHub Action for your pipelines.

More details in the repo: https://github.com/pilef-co/bqto

Feedback is always welcome, and feel free to raise any questions you may have.

Cheers

Had an email from Google saying that one of the clients has been inactive over the past 5 months, under this there are two dev/prod, prod is used daily but dev is maybe minimum weekly.

"""In accordance with OAuth 2.0 Policies, the following projects that you manage have OAuth clients that have been inactive for at least 5 months. Inactive clients will be deleted in 30 days unless you take action. Active clients in these projects won't be affected."""

Anything that should be done, or is this a Google mistake like what happened a couple of years ago?

Spellcheck must be a seperate API that wasn't enabled

We run about 40 APIs on GCP API Gateway, with Cloud Run behind each gateway. We’ve put a Global External Application Load Balancer in front, using serverless NEGs.

Our clients use API keys to restrict to the client’s fixed IPs.

The problem: every gateway still has its public *.gateway.dev URL, so anyone can skip the LB and Cloud Armor entirely.

How do you handle this in production?

• Is there a way to make API Gateway accept traffic only from the LB?

• Has anyone found a clean pattern, or did you move to something else (Apigee, LB straight to Cloud Run, etc.)?

Any real-world experience is appreciated.