May 13, 2026Unverified
Stolen Google Cloud API keys run up $3K–$127K Gemini bills for developers
AI loose in the worldAvailabilityDERIVED
Approved by person, Oct 11, 2026. How entries are approved
Attackers used compromised Google Cloud API keys to run Gemini, Veo and other expensive models, leaving developers with surprise bills from a few thousand dollars up to $127,000. The Register reported that one developer with a $250 spending cap woke up to a $10,000 bill after Google's automatic tier upgrades raised his effective limit without notification.
What this means for youIf you use Google Cloud or Gemini, a stolen API key can run up large bills without you noticing, so check your API keys and set billing alerts. Small businesses should rotate any key that may have leaked and ask their cloud provider to confirm spending caps apply to all tiers.
Sources
- The Registerhttps://www.theregister.com/ai-ml/2026/05/13/google-users-fight-for-refunds-as-unauthorized-api-usage-bills-soar/5239160
Incident records from the AI Agent Incident Database by sipi.bot (https://sipi.bot/incidents/), licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).
Source data license: CC BY 4.0. Attribution to sipi.bot is required.
Covered by snapshot 45
da93f03b406f409940d0a6ef47b526607f82ebf457d98f69299b88aceede576a
This entry is record number 2233. It has not been edited since it was approved; the hash above would not match if it had. How to verify