Suspended Project with Suspected API Key Abuse – Need Access to Detailed Gemini API Logs

Gemini API
1

We are investigating a significant and unexpected spike in API usage associated with our Google Cloud project:

The project has been suspended due to suspected abusive activity consistent with potential API key compromise or hijacking. During the impacted period (March 21–23, 2026), we observed a substantial increase in usage and charges, primarily driven by:

  • Gemini API (image generation – high token output)

  • Places API (new usage observed)

At this time, we are attempting to perform a deep-dive investigation to determine:

  • The origin of the API calls (source IPs, regions)

  • Request metadata (headers, user agents, authentication method)

  • Whether the activity was authenticated vs unauthenticated

  • Any indicators of API key misuse or external abuse