A forgotten Google Cloud API key was abused for 60,000+ requests and an $18,000+ bill.

What happened

In April 2026, Tom's Hardware reported the case of Australian AI consultant Jesse Davies, who discovered a Google Cloud bill of A$25,672.86, about US$18,391 at the time. The report says a publicly reachable Cloud Run service still exposed an API key through an environment variable. An attacker used the path for more than 60,000 requests.

The report also says the customer had configured a much smaller budget and spending cap, but the abusive traffic still accumulated charges before the issue was resolved. Google ultimately waived the charges.

Why this matters

A budget notification is not the same thing as a deny decision. If a workload can continue presenting a long-lived credential after its intended spend or authority is exceeded, the financial control exists outside the execution path.

Where RaksHex fits

For traffic routed through RaksHex, the useful controls are credential mediation, workload identity, a deterministic spend policy and a kill switch. A compromised static provider key that bypasses RaksHex is outside that boundary, so it would be wrong to claim the product automatically eliminates credential theft.

That is why this incident is labelled Reducible, not guaranteed Preventable. RaksHex can reduce blast radius when the credential and paid execution path are mediated through it; it cannot control traffic that never reaches its enforcement point.

Source

Tom's Hardware, April 2026. The financial figures and request count above come from that report.