Exposed Gemini API Key Reportedly Led to $82,000 Bill for Small Developer Team
Summary
A Mexican three-person development team reportedly had its exposed Gemini API key abused, driving an $82,000 bill in 48 hours versus a typical $180 monthly cost. Google reportedly declined to cancel the charge; the article says Cloud lacks hard spending caps.
Key points
- A Mexican three-person development team reportedly exposed a Google Gemini API key publicly, after which attackers used it to make unauthorized requests.
- The team’s usual monthly bill was about $180; the article says charges reached $82,000 in 48 hours.
- The team is reportedly disputing the invoice, while Google cited its shared-responsibility model and declined to cancel the charge.
- The article says Google Cloud limits API request rates but does not provide a hard spending cap that automatically stops costs.
- It advises developers to secure API keys and check quota protections before deploying cloud-based AI services.
Article Details
- Victim Organization
- Unknown
- Incident Type
- Accidental public exposure of a Google Gemini API key followed by unauthorized API usage
- Data Types Exposed
- Google Gemini API key
- Operational Impact
- The team reportedly incurred an $82,000 bill in 48 hours, compared with its typical monthly bill of $180. The article says unpaid charges could result in loss of access to Google Gemini and possible legal ramifications; it does not report that access was actually cut off.
- Ransom Or Extortion
- None reported
- Claim Status
- alleged
Vendors
Products
Google CloudThe team is now disputing the charge with Google amid criticism of shared-responsibility policies and Google Cloud’s lack of hard spending quotas, which left them financially liable.Google GeminiA Mexican developer on a three-person team accidentally exposed their Google Gemini API key and attackers exploited it to generate an $82,000 bill in 48 hours.