Gemini API key 被盗刷 2230 美元，攻击者调用 Argon
用户轮换 150 多个 key 时 Gemini key 泄露，被刷超 2230 美元，攻击者调用的正是他们从不使用的 gemini 4 argon。
ive been rotating over 150+ keys since yesterday but this morning my gemini key was compromised.. the attacker was able to run up over $2,230 of spend on the key before I caught it and revoked it here are 5 things i wish i had set up before today 1. an agent watching the logs 24/7. as of now ours checks aws, stripe, billing emails and provider usage every 10 min. when something fires, it investigates on its own and sends me a report on telegram 2. doppler for deployed apps. i just set up one token per app/environment. i could have rotated everything from here much faster.. 3. usage limits and caps on models we're not using. the attacker ran gemini 4 argon, a model we never call. google lets you cap requests per model per day, so i just set those to 0 4. one key per app, per place. our aws key lived in railway, github actions and a script on our server. rotating it meant breaking all three. now each one has its own key that can only do its one job 5. a keymaster for the team. one agent issues every key. each teammate and bot gets their own scoped key at run time what else would you add?