Stuck for 60 days with $19,000 bill due to Gemini privilege escalation on a legacy 2018 Maps key - Case ID: 72347951

Gemini API
1

Hello Google AI Community and Product Managers,

Our organization is facing a critical business-blocking situation. We have an unauthorized billing spike of ~$19,000 USD on our Google Cloud account.

The case has been open with Google Billing Support for over 2 months (Case ID:72347951), but we are stuck in a loop of agents asking for “5 to 7 more business days” to get a response from leadership.

Here are the undeniable technical facts of the incident that prove a platform-level issue:

  • API Key Name: Fitotrazabilidad
  • API Key ID (UUID): 3b387470-b26b-4346-b03c-ccf03155a369
  • Creation Date: November 30, 2018, 11:04:21 AM GMT-3 (Nearly 8 years ago)
  • Original Intended Use: Maps API
  • Project Status: The project never reached production status.
  • Compromise Vector: There is absolutely no evidence of a compromised Service Account key or server breach.

This is a textbook case of the “Silent Privilege Escalation” architecture vulnerability. A legacy, unrestricted key from 2018—created long before Gemini existed—automatically and retroactively inherited full permissions to call the Generative Language API when the service became available in the project ecosystem.

Third-party attackers discovered this legacy key and flooded the Gemini API at machine speed, completely bypassing standard billing alert thresholds before we could react.

Given that this key was never used in production and inherited these massive AI billing capabilities without our explicit consent or quota configuration, we urgently request a Google Product Manager or Escalation Specialist to look into our Case ID and fast-track a full billing adjustment.

Thank you for your urgent assistance.

2

URGENT UPDATE: Our official Google Cloud Reseller (IPLAN) just notified us that they can no longer hold the invoice because Google already swept the $19k from their partner credit lines. They are now forcing us into a payment plan to cover the loss of a platform-level vulnerability.

Google is actively damaging its own reseller ecosystem and forcing local partners to collect unauthorized bills from clients for a 2018 non-production Maps key issue. We need a Cloud Billing Escalation Manager to step in immediately before this causes a severe legal and local financial escalation. Case ID: 72347951.