Google Cloud customer wakes up to $18,000+ bill despite $7 budget, thanks to forgotten API key in published project — attacker put in 60,000+ requests and blast
“The attacker didn’t steal my key. They found a Cloud Run service I’d published from AI Studio months earlier, hit the public URL, and Google’s own proxy signed every request on their behalf using the API key stored as a…









