(C) BoingBoing
This story was originally published by BoingBoing and is unaltered.
 . . . . . . . . . .



Stolen Gemini API key racks up $82,000 in 48 hours for solo dev [1]

['Ellsworth Toohey']

Date: 2026-02-27  

If someone steals your credit card and racks up fraudulent charges, your bank will reverse them. If someone steals your cloud API key and racks up $82,000 in compute charges over a weekend, you owe Google the money. That is the state of consumer protection in cloud computing in 2024.

A solo developer in Vietnam who uses Google's Gemini API for a personal project — normal monthly bill around $180 — posted to Reddit's r/googlecloud that a stolen API key ran his bill to $82,000 in 48 hours. He had billing alerts configured, but they arrived after the damage was done. Google has not forgiven the charges. He says he is facing bankruptcy.

The Reddit thread is filled with similar stories. Cloud providers — Google, AWS, Azure — all operate on the same model: usage is metered, billing is retroactive, and there is no hard spending cap that actually kills the service when a threshold is crossed. Billing alerts are notifications, not circuit breakers. By the time you read the email, the meter has been running for hours. For a company burning through millions a month, an anomalous spike gets caught by a finance team. For a solo developer in a country where $82,000 is a life-altering sum, there is no safety net at all.

Credit card companies solved this problem decades ago with fraud detection and liability caps. Cloud providers have chosen not to. A hard spending limit — service stops when the bill hits a ceiling you set — would be trivial to implement. The question is why none of them offer it as a default.

Previously:

[END]
---
[1] Url: https://boingboing.net/2026/02/27/stolen-gemini-api-key-racks-up-82000-in-48-hours-for-solo-dev.html

Published and (C) by BoingBoing
Content appears here under this condition or license: Creative Commons BY-NC-SA 3.0.

via Magical.Fish Gopher News Feeds:
gopher://magical.fish/1/feeds/news/boingboing/