Leaked Gemini key racked up $2,230, attacker called Argon
A user's Gemini key was compromised and run up over $2,230, with the attacker calling gemini 4 argon, a model they never use.
ive been rotating over 150+ keys since yesterday but this morning my gemini key was compromised.. the attacker was able to run up over $2,230 of spend on the key before I caught it and revoked it here are 5 things i wish i had set up before today 1. an agent watching the logs 24/7. as of now ours checks aws, stripe, billing emails and provider usage every 10 min. when something fires, it investigates on its own and sends me a report on telegram 2. doppler for deployed apps. i just set up one token per app/environment. i could have rotated everything from here much faster.. 3. usage limits and caps on models we're not using. the attacker ran gemini 4 argon, a model we never call. google lets you cap requests per model per day, so i just set those to 0 4. one key per app, per place. our aws key lived in railway, github actions and a script on our server. rotating it meant breaking all three. now each one has its own key that can only do its one job 5. a keymaster for the team. one agent issues every key. each teammate and bot gets their own scoped key at run time what else would you add?