Reported incidents included more than $10,000 in charges generated within roughly 30 minutes, while another developer faced approximately AUD $17,000 in unauthorized usage. Researchers also noted that billing limits may have been automatically increased based on account activity, potentially exposing users to significantly larger financial risks than expected.

Security researchers additionally discovered that revoked API keys could reportedly remain usable for up to 23 minutes due to delayed revocation propagation inside Google’s infrastructure. During that period, attackers may still access files, prompts, or cached AI conversations.

As AI services become deeply integrated into cloud platforms, developers and startups are increasingly learning that operational security failures can quickly escalate into major financial liabilities.