Stolen Google Cloud API keys run up $3K–$127K Gemini bills for developers
Google Cloud customers (multiple developers) · May 13, 2026 · General agent
What happened
Attackers used compromised Google Cloud API keys to run Gemini, Veo and other expensive models, leaving developers with surprise bills from a few thousand dollars up to $127,000. The Register reported that one developer with a $250 spending cap woke up to a $10,000 bill after Google's automatic tier upgrades raised his effective limit without notification.
Causal vector
Compromised API keys plus automatic spending-tier upgrades — stolen credentials amplified by a provider-side ceiling that silently moved
Source
Reported by The Register. Verified against the primary report.
A credential leak should not equal an unbounded bill. A spend firewall's merchant allowlist and per-transaction caps stop a stolen key from being monetized at inference time, and velocity limits cap the damage even when a key is compromised.
The six rule types that contain this class of failure
Per-transaction cap
Any single spend above your ceiling is BLOCKED before it moves.
Daily total
Cumulative spend across all agent calls, bounded per day.
Velocity limit
Stops runaway retry loops — the #1 cause of overnight losses.
Merchant allowlist
Only approved destinations can ever receive funds.
Category rules
Flag high-risk classes (crypto, infra, refunds) for review.
Approval threshold
Above a value, the action waits for a human.
Related incidents
Three-person agency hit with a $14,000 AWS Bedrock bill after attackers burn stolen keys on Claude
Amazon Bedrock (customer: three-person agency) · Jul 16, 2026
AWS user faces a $30K–$38K Bedrock bill that cost-anomaly detection never flagged
AWS Bedrock customer (individual developer) · May 14, 2026
Gartner: worldwide AI spending forecast at $2.52 trillion in 2026, up 44% YoY
Gartner / Portal26 · Jan 1, 2026
Don't be the next entry
Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 67 documented failures, one control.