For developers, an API key is like a bank card password. Once leaked, the consequences can be disastrous. Recently, a three-person development team from Mexico posted on the social platform Reddit, seeking help, stating that due to an operational mistake, they accidentally exposed the Google Gemini API key to the public. Within 48 hours, they received a huge bill of $82,000 (about 590,000 RMB).

The developer stated that their team's monthly Gemini usage cost was only about $180. However, because the key was被抓取 by malicious crawlers and used illegally, the bill surged exponentially within two days. Facing this "astronomical" amount they couldn't afford, the team contacted Google support engineers to request a reduction, but the response was very cold: According to Google Cloud's "shared responsibility model," protecting the key's security is the user's responsibility, not the platform's mistake, so they had to pay the full amount.

This incident has once again sparked collective complaints from developers about Google Cloud's billing mechanism. Unlike platforms like OpenAI, which generally adopt a "prepaid + consumption cap" model, Google Cloud does not default to a hard budget cut-off mechanism. Although the platform has a budget alert function, if developers don't set it in advance or don't check their emails in time, the system will not automatically block services even if the request volume suddenly increases dramatically.

In contrast, competitors like OpenAI will immediately shut off API access once the balance runs out. Google provides "request rate limiting" rather than "consumption cap limiting," which objectively leaves a loophole for the generation of "astronomical bills." At present, the developer is still negotiating with Google. Industry experts remind developers to check whether the platform supports mandatory consumption limits when calling various AI models. If there are no relevant security mechanisms, they should be extremely cautious in keeping the keys.

Key Points

  • 💸 590,000 RMB bill in 48 hours: Due to the leakage of the key, the API was abused, causing a financial loss that a small team of three could not bear.

  • 🚫 Google refuses to pay: Based on the "shared responsibility model," Google believes that developers should bear all the costs caused by their own security mistakes.

  • ⚠️ Questioned mechanism defects: Developers are calling on Google to improve quota management and add features similar to OpenAI's "automatic cut-off once balance is exhausted" to prevent such tragedies from happening again.